A blockchain-based distributed enterprise data hierarchical decentralization service management method

Abstract

This invention discloses a blockchain-based distributed enterprise data hierarchical and decentralized service management method, relating to the field of blockchain data security technology. The method includes: real-time collection of multi-source heterogeneous enterprise data; preprocessing of the multi-source heterogeneous data; extraction of multi-dimensional management entities using NLP entity recognition methods; construction of a knowledge graph; analysis of the correlation between multi-dimensional management entities using graph neural networks based on the knowledge graph; and generation of a hierarchical knowledge graph by using a rule engine to divide the data into core, departmental, and public layers; and control of hierarchical protection of enterprise data output through access authorization tokens to obtain the hierarchically decentralized enterprise data. This invention improves the automation level and operational efficiency of enterprise data management.

Description

Technical Field

[0001] This invention relates to the field of blockchain data security technology, and in particular to a distributed enterprise data hierarchical and decentralized service management method based on blockchain. Background Technology

[0002] As enterprises accelerate their digital transformation, the value of data assets is becoming increasingly prominent, and data security and access management technologies are also constantly evolving. Currently, mainstream data protection solutions generally adopt a combination of role-based access control (RBAC) and attribute-based encryption (ABE) to achieve hierarchical and classified protection of data. Among these, the introduction of blockchain technology further enhances the immutability and audit transparency of access policies.

[0003] However, conventional solutions are limited by their reliance on static permission policies, which cannot adjust access permissions in real time based on the dynamic relationships between enterprise data entities. For example, in cross-departmental collaboration scenarios, administrators need to manually adjust permission settings, increasing operational costs and causing delays in permission updates, making it difficult to achieve fine-grained dynamic access control. This deficiency makes highly sensitive data vulnerable to indirect access through low-privilege paths, failing to meet the modern enterprise's need for real-time and accurate data permission management. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a blockchain-based distributed enterprise data hierarchical and decentralized service management method to solve the problem of not being able to adjust access permissions in real time based on the dynamic relationship between enterprise data entities.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: Firstly, this invention provides a blockchain-based distributed enterprise data hierarchical and decentralized service management method, comprising: real-time collection of multi-source heterogeneous enterprise data; preprocessing of the multi-source heterogeneous enterprise data; extracting multi-dimensional management entities using NLP entity recognition methods to construct a knowledge graph; based on the knowledge graph, analyzing the correlation of multi-dimensional management entities using graph neural networks; and using a rule engine to divide the data into a core layer, a department layer, and a public layer to generate a hierarchical knowledge graph; using smart contract programming to convert hierarchical tags into permission policies, and deploying them to blockchain nodes using the PBFT consensus algorithm to obtain a distributed permission control contract; verifying user identity using the BGW protocol; querying access paths from the hierarchical knowledge graph using a graph traversal algorithm; outputting access authorization tokens; encrypting the core layer using an attribute-based encryption strategy; desensitizing the department layer using differential privacy; configuring the public layer in plaintext state to obtain hierarchically protected enterprise data; and controlling the output of hierarchically protected enterprise data through access authorization tokens to obtain enterprise data after hierarchical and decentralized management.

[0007] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method described in this invention, the enterprise multi-source heterogeneous data includes financial transaction record data, commodity code data, user relationship data, contract document data, supply chain log data, and surveillance video data. The preprocessing includes removing duplicate and outlier values, filling in missing values, standardizing timestamp formats, and marking sensitive data.

[0008] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method of the present invention, the step of extracting multi-dimensional management entities and constructing a knowledge graph using NLP entity recognition methods is as follows: Based on preprocessed multi-source heterogeneous enterprise data, NLP entity recognition methods are used to extract user entities, enterprise data entities, and business entities to obtain multi-dimensional management entities. Based on multi-dimensional management entities, a graph database modeling method is used to perform semantic analysis and establish the hierarchical relationships and business associations between multi-dimensional management entities; The Louvain algorithm is used to calculate the weights of membership and business associations, and density clustering is performed with the business associations to construct a knowledge graph with timestamps.

[0009] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method of the present invention, the step of using a knowledge graph to analyze the multi-dimensional management entity correlation through graph neural networks and using a rule engine to divide the data into a core layer, a departmental layer, and a public layer to generate a hierarchical knowledge graph is as follows: Based on historical multi-dimensional management entities, a graph neural network is trained using a semi-supervised graph representation learning method; The multi-dimensional management entities are input into the trained graph neural network, and feature fusion and relationship enhancement are performed through node embedding and edge weight propagation algorithms to generate edge weights for the multi-dimensional management entity association. Based on the edge weights of multi-dimensional management of entity association, a rule engine is used to perform multi-dimensional quantitative evaluation through predefined sensitivity judgment rules, generate triples with hierarchical labels, and reconstruct the knowledge graph topology. The core layer, department layer and public layer are divided according to hierarchical labels and mapped to independent subgraph spaces respectively. At the same time, cross-layer association edges are retained to generate a hierarchical knowledge graph.

[0010] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method described in this invention, the specific steps of using smart contract programming to convert hierarchical tags into permission policies and deploying them to blockchain nodes using the PBFT consensus algorithm to obtain a distributed permission control contract are as follows: Input the triplet hierarchical labels in the hierarchical knowledge graph into the smart contract compiler, and convert them into programmable permission policy code segments through a pre-defined permission rule table; The PBFT consensus algorithm is used to perform distributed verification and contract deployment among blockchain nodes, generating an immutable permission control contract address on the blockchain. The immutable access control contract address is hash-bound to the version identifier of the hierarchical knowledge graph and updated to the blockchain node storage to obtain the distributed access control contract corresponding to the hierarchical knowledge graph.

[0011] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method of the present invention, the steps of verifying user identity using the BGW protocol, querying the access path from the hierarchical knowledge graph using a graph traversal algorithm, and outputting an access authorization token are as follows: User identity credentials are input into the BGW protocol, and their authenticity is verified through multiple security methods. Starting with verified users, a graph traversal algorithm with permission constraints is used in the layered knowledge graph. The distributed permission control contract is input to perform access path edge weight aggregation and cross-layer edge filtering, and the access path set is output. Based on the edge weights of the access path set and the distributed permission control contract, permission aggregation and dynamic allocation of validity periods are performed to generate access authorization tokens with validity periods and operational scope.

[0012] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method of the present invention, the core layer is encrypted using an attribute-based encryption strategy, and the departmental layers are de-identified using differential privacy. The public layer is configured in plaintext to obtain hierarchically protected enterprise data. The specific steps are as follows: An attribute-based encryption strategy is adopted to parse the distributed access control contract to generate the corresponding encrypted public key parameters, and then encrypt the core layer. The department layer is input into the differential privacy engine, which filters sensitive fields based on the mapping relationship between the hierarchical knowledge graph and the differential privacy parameters, outputs the de-identified department layer, configures the public layer to plaintext, and merges it with the core layer and department layer to form a hierarchical protection for enterprise data.

[0013] As a preferred embodiment of the blockchain-based distributed enterprise data hierarchical and decentralized service management method of the present invention, the specific steps for controlling the hierarchical protection of enterprise data output through access authorization tokens and obtaining enterprise data after hierarchical and decentralized management are as follows: The access authorization token's ECDSA signature is parsed using an asymmetric signature verification algorithm, its validity is verified using the public key parameter, and the content of the access authorization token is output after decryption. Based on access authorization tokens, content control layers protect enterprise data output, resulting in enterprise data that has been layered and authorized.

[0014] In a second aspect, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein when the computer program is executed by the processor, it implements any step of the blockchain-based distributed enterprise data hierarchical and decentralized service management method described in the first aspect of the present invention.

[0015] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the blockchain-based distributed enterprise data hierarchical and decentralized service management method described in the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: By dynamically analyzing the correlation between enterprise data entities through graph neural networks, a hierarchical knowledge graph is constructed, enabling the enterprise's data sensitivity to automatically adjust with business changes; the distributed design based on blockchain not only enhances the disaster recovery capability and consistency of permission policies, but also retains key business chains in the data hierarchy, taking into account both data security and business logic; hashing the contract address with the knowledge graph version provides verifiable and tamper-proof permission audit and tracing capabilities; and it improves the automation level and operational efficiency of enterprise data management, providing a secure and reliable foundation for enterprise data sharing for cross-departmental collaboration. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart for a blockchain-based distributed enterprise data hierarchical and decentralized service management method.

[0019] Figure 2 A flowchart for building a knowledge graph.

[0020] Figure 3 This is a flowchart for hierarchical access control.

[0021] Figure 4 A flowchart for layered data protection. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figures 1-4 This is one embodiment of the present invention, which provides a blockchain-based distributed enterprise data hierarchical and decentralized service management method, including the following steps: S1. Collect multi-source heterogeneous data from enterprises in real time and preprocess the multi-source heterogeneous data.

[0026] S1.1 Enterprise multi-source heterogeneous data includes financial transaction record data, commodity code data, user relationship data, contract document data, supply chain log data, and surveillance video data.

[0027] Specifically, the enterprise's multi-source heterogeneous data includes financial transaction records, product code data, user relationship data, contract document data, supply chain log data, and surveillance video data. Financial transaction records are derived from bank transfer slips, electronic payment platform transaction records, and accounting vouchers in the enterprise's daily income and expenditure operations. Product code data is generated from unique identifiers assigned according to the international standard classification system in the product management process. User relationship data is collected from registration information, interaction behavior, and social network connections in the customer management process. Contract document data is generated from electronic agreements or scanned copies of paper documents produced in the process of signing between the enterprise's legal department and external institutions. Supply chain log data is generated from the operation records of GPS positioning devices, RFID scanning equipment, and warehouse management terminals in the logistics and transportation process. Surveillance video data is obtained from real-time or historical image storage files of enterprise security cameras, production line visual inspection equipment, and meeting recording tools.

[0028] S1.2 Preprocessing includes removing duplicate and outlier values, filling missing values, standardizing timestamp formats, and marking sensitive data.

[0029] Specifically, duplicate values ​​are removed by comparing the hash values ​​of combined fields in the enterprise's multi-source heterogeneous data using a hash algorithm, and deleting records with the same hash value; outliers are removed by using the Z-score statistical method to identify and delete enterprise multi-source heterogeneous data rows that exceed the Z-score threshold, such as those with an absolute Z-score value > 3 in the amount field of financial transaction records; missing value imputation uses the mean substitution method to calculate the mean of non-empty records for numerical fields, such as the inventory field in commodity code data, or uses interpolation to linearly imput the values ​​of preceding and following records for time series fields, such as temperature records in supply chain log data; and the unified timestamp format is achieved by converting strings of different formats using rules, such as converting "January 1, 2023" to "2023-01-01". The format is "00:00:00". Sensitive data is marked by matching the 18-digit ID card number format in user relationship data (the first 6 digits are the region code, the 8 digits are the birth date, the 3 digits are the sequence code, and the 1 digit is the check code, for example, "11010119900101XXXX"). The bank account field in contract document data is matched with 16-19 consecutive digits. Customized code prefixes involving trade secrets (such as "CONF-2023-XXXX") in commodity code data are marked.

[0030] S2. Extract multi-dimensional management entities using NLP entity recognition methods and construct a knowledge graph.

[0031] S2.1 Based on the preprocessed multi-source heterogeneous enterprise data, NLP entity recognition methods are used to extract user entities, enterprise data entities, and business entities to obtain multi-dimensional management entities.

[0032] Specifically, the preprocessed multi-source heterogeneous enterprise data input sequence labeling process involves: contract document data, which uses word vector embedding and contextual semantic analysis to identify the full names of organizations following "Party A" and "Party B" in the clauses as user entities; financial transaction record data, which uses a sequence labeling framework to parse the numerical attributes and contextual relationships of fields such as amount, transaction time, and account number, and label them as enterprise data entities; supply chain log data, which uses dependency syntax structure and attention mechanism weight analysis to analyze the semantic relationships of action phrases such as "shipment," "receipt," and "inventory adjustment," and classify business entities; user relationship data, which uses relationship extraction technology to identify entity boundaries of name, position, and contact information in graph structure nodes; and commodity code data, which uses semantic mapping... Similarity calculation matches the correlation between international classification standard codes and descriptive text to generate enterprise data entities with classification labels; metadata of surveillance video data is extracted based on the text description parsing process to associate entity fragments with shooting time and location numbers to business entities; the identification results of named user entities, enterprise data entities, and business entities are corrected for error boundaries by a sequence labeling optimization layer; node table structures are created for user entities, enterprise data entities, and business entities respectively, and node ID, attribute fields, edge types, and weight fields are defined; the attribute fields store the characteristics of user entities, enterprise data entities, and business entities, and the edge types and weight fields describe the entity relationships, forming a multi-dimensional management entity set.

[0033] S2.2 Based on multi-dimensional management entities, a graph database modeling method is used to perform semantic analysis and establish the hierarchical relationships and business associations between multi-dimensional management entities.

[0034] Specifically, the process involves inputting the multi-dimensional management entity set into a graph database for modeling. For user entities, the signatory name field in contract document data is parsed, matching departmental hierarchical relationships, creating membership edge types and setting weights in the graph database node attribute table. For enterprise data entities, the account number field in financial transaction record data is parsed, associating it with the product category number in product code data, creating business association edge types, with weights calculated based on transaction frequency and amount. For business entities, the action field in supply chain log data is parsed, matching the metadata timestamp field of monitoring video data with the operation time field in the supply chain log data for time window matching and alignment, creating time association edge types and recording the operation time. The semantic analysis process traverses the context description fields of the multi-dimensional management entity set, extracting keyword co-occurrence relationships, and creating semantic association edge types. The timestamp field records the effective time of each edge association, completing the semantic analysis of membership and business relationships between multi-dimensional management entities.

[0035] S2.3 Calculate the weights of membership and business associations using the Louvain algorithm, and perform density clustering with the business associations to construct a knowledge graph with timestamps.

[0036] It should be noted that the expression for calculating the weights of membership and business association using the Louvain algorithm is as follows: ;

[0037] in, It is the weight of the membership relationship. It is the natural constant ≈ 2.718. It is the duration of affiliation. It is the depth of the hierarchical level. The membership time decay coefficient ranges from 0.05 to 0.2. The attenuation coefficient of the membership level is in the range of 0.2-0.5. It is a business-related weight. Users with high frequency of business interactions Access Contract Number of times, User Total visits It is a contract Total number of visits It is the user. It's a contract; The depth of the subordinate hierarchy is set based on the hierarchical position or superior-subordinate relationship of the multi-dimensional management entity in the organizational structure; The membership time decay coefficient is set based on the duration of the membership relationship between multi-dimensional management entities and the degree of decay of the influence of time on the strength of the membership relationship; The attenuation coefficient of the affiliation level is set based on the differences in the depth of the organizational hierarchy between multi-dimensional management entities and the degree of attenuation of the influence of changes in hierarchy on the strength of the affiliation relationship; Business association weights are calculated based on the frequency of business interactions between multi-dimensional management entities and their respective total access volume.

[0038] Specifically, the Louvain algorithm calculation process is used to input the hierarchical relationships and business associations between multi-dimensional management entities. The hierarchical relationship weight calculation employs a weighted sum of a time decay coefficient and a hierarchical decay coefficient, then transformed using the Sigmoid function. The time decay coefficient ranges from 0.05 to 0.2; for example, the hierarchical decay coefficient increases by 0.1 for each additional level of hierarchy, and ranges from 0.2 to 0.5. For example, the hierarchical decay coefficient from a second-level department to a third-level department is set to 0.3. The business association weight calculation uses the ratio of the frequency of business interactions to the geometric mean of total accesses; for example, the frequency of user interactions... Access Contract The number of times was 15, and the user Total visits: 100; Contract With a total of 200 visits, the business association weight is calculated as 15 / √(100×200)=0.106. The Louvain algorithm initializes multi-dimensional management entities as independent communities. When merging communities, the gain value after merging is calculated, and only merging operations with a gain value exceeding 0.3 are retained. Business associations are density-clustered to filter multi-dimensional management entity groups within the same community whose business interaction frequency exceeds the 75th percentile of the historical transaction frequency distribution (e.g., interaction frequency exceeding 20 times). The timestamp field records the calculation time of the affiliation weight and business association weight, such as 2023-01-01 10:00:00 and the community merging time, such as 2023-01-01 10:05:00. A knowledge graph with timestamps is generated. Each edge in the knowledge graph stores the weight value, association type, and effective time. Each node stores the multi-dimensional management entity type, attribute fields, and the community number to which it belongs.

[0039] S3. Based on knowledge graphs, analyze the multi-dimensional relationship between management entities through graph neural networks, and use a rule engine to divide the core layer, departmental layer and public layer to generate a hierarchical knowledge graph.

[0040] S3.1. Based on historical multi-dimensional management entities, a graph neural network is trained using a semi-supervised graph representation learning method.

[0041] Specifically, the training process for historical multi-dimensional management entity input involves the following: user entities, enterprise data entities, and business entities undergo attribute quantification: the department level field of user entities is converted to hierarchical depth coding (e.g., first-level department code is 1, second-level department code is 2), and the position field is mapped to a predefined category code (e.g., manager code is 100, employee code is 200); the amount field of enterprise data entities retains its original value, the transaction count field is converted to a numerical statistic, and the product code field is mapped to an international classification standard numerical code; the operation action field of business entities is converted to action type coding (e.g., shipping code is 1, receipt code is 2), and the timestamp field is converted to a Unix timestamp value; the Unix timestamp values ​​are concatenated into node feature vectors. For example, the user entity feature vector includes hierarchical depth coding, position code, contact information hash value, and the weights of membership, business association, time association, and semantic association edges as edge features. During the training of the graph neural network, the attribute numerical vectors of user entities, enterprise data entities, and business entities are weighted and aggregated through edge weights: the weight of the membership edge controls the feature propagation intensity of department-level nodes, the weight of the business association edge determines the feature fusion ratio of transaction-related nodes, for example, a business association edge with a weight of 0.9 will fuse the features of the transaction node to the product node at a ratio of 90%, the weight of the time association edge adjusts the influence of the temporal features of the time window matching node, and the weight of the semantic association edge constrains the semantic similarity contribution of the keyword co-occurrence node, for example, a semantic association edge with a weight of 0.75 will transmit the features of the contract clause node to the supply chain node with a strength of 75%. The semi-supervised graph representation learning method combines the classification error of labeled nodes with the consistency constraint of the edge weights of unlabeled nodes to complete the training of the graph neural network.

[0042] S3.2 Input the multi-dimensional management entities into the trained graph neural network, and perform feature fusion and relationship enhancement through node embedding and edge weight propagation algorithms to generate edge weights for the multi-dimensional management entity correlation.

[0043] Specifically, the graph neural network trained on multi-dimensional management entity inputs loads node feature vectors from user entities, enterprise data entities, and business entities during the node embedding generation process. The hierarchical depth encoding and job category encoding of user entities, along with the monetary value and product classification encoding of enterprise data entities, are input into the fully connected layer of the graph neural network and mapped to a 128-dimensional vector space. The edge weight propagation algorithm traverses the weight values ​​of membership edges, business association edges, time association edges, and semantic association edges. User entity nodes aggregate the node embedding features of associated departments through membership edge weights (e.g., 0.6), enterprise data entity nodes fuse the embedding features of counterparty nodes through business association edge weights (e.g., 0.9), and business entity nodes integrate the monitoring node features of time window matching through time association edge weights (e.g., 0.7). After feature fusion, the node embeddings are calculated using cosine similarity. The embedding similarity between user entities and department nodes is superimposed with the original affiliation weights to generate new affiliations. For example, a cosine similarity of 0.8 combined with the original weight of 0.6 generates a new weight of 0.75. The embedding similarity between enterprise data entities and counterparty nodes is combined with business-related edge weights to generate new related edge weights. For example, a cosine similarity of 0.7 combined with the original weight of 0.9 generates a new weight of 0.85. The edge weight update process iterates through all edge types. The new weights of time-related edges are calculated by weighted summation of temporal feature similarity and the original time-related edges. The new weights of semantic-related edges are adjusted based on the product of keyword co-occurrence frequency and embedding similarity. For example, a co-occurrence frequency of 10 times combined with a similarity of 0.8 generates a new weight of 0.8 for semantic-related edges. This generates edge weights for multi-dimensional management of entity affiliations.

[0044] S3.3. Based on the edge weights of multi-dimensional management of entity association, a rule engine is used to perform multi-dimensional quantitative evaluation through predefined sensitivity judgment rules, generate triples with hierarchical labels, and reconstruct the knowledge graph topology. The core layer, department layer and public layer are divided according to hierarchical labels and mapped to independent subgraph spaces respectively. At the same time, cross-layer association edges are retained to generate a hierarchical knowledge graph.

[0045] Specifically, by analyzing the edge weight distribution patterns and node attribute characteristics of historical multi-dimensional management entities, and combining the density clustering results with business associations, sensitive fields and permission levels in the enterprise data classification standards are mapped, and sensitivity judgment rules are generated by referencing historical violation cases to verify the effectiveness of the rules. The edge weight input rule engine manages the relationship between entities in multiple dimensions. It uses sensitivity judgment rules to quantitatively evaluate edges in multiple dimensions. Edges with a weight greater than 0.8 are marked as core layer relationships. For example, the edge between a user entity and a first-level department with a weight of 0.85 is marked as core layer. Edges with a weight between 0.5 and 0.8 are marked as department layer relationships. For example, the edge between a user entity and a product node with a weight of 0.7 is marked as department layer. Edges with a weight less than 0.5 and a node sensitivity mark of no are marked as semantic relationship relationships. For example, the edge between a product code node and a public contract with a weight of 0.3 is marked as public layer. User entity nodes are assigned hierarchical labels based on departmental level codes; for example, a first-level department with code 1 is labeled as a core-level user. Enterprise data entity nodes are assigned hierarchical labels based on monetary value and sensitivity markers; for example, amounts exceeding 1 million yuan and marked as sensitive are labeled as core-level data. Business entity nodes are assigned hierarchical labels based on operation type; for example, approval actions are labeled as core-level business. The knowledge graph reconstruction process maps core-level nodes to core-level subgraphs, such as executive user entities and high-amount enterprise data entities. Departmental-level nodes are mapped to departmental-level subgraphs, such as departmental user entities and regular transaction data entities. Public-level nodes are mapped to public-level subgraphs, such as public product code entities and non-sensitive contract entities. Cross-level association edges retain rules to filter the membership relationship edges and business association edges between different subgraphs; for example, the membership edge between core-level user entities and departmental-level sub-department nodes, and the business edge between departmental-level transaction entities and public-level product nodes, retaining the original weights and timestamps to generate a hierarchical knowledge graph.

[0046] S4. Use smart contract programming to convert hierarchical tags into permission policies, and deploy them to blockchain nodes using the PBFT consensus algorithm to obtain a distributed permission control contract.

[0047] S4.1 Input the triplet hierarchical labels in the hierarchical knowledge graph into the smart contract compiler, and convert them into programmable permission policy code segments through the pre-set permission rule table.

[0048] Specifically, the triplet hierarchical labels in the hierarchical knowledge graph are input into the smart contract compiler. The membership relationship edges associated with core layer nodes are matched with the user entity department hierarchical codes to obtain core layer access control entries in the pre-set permission rule table, which are then converted into user-level permission verification conditions. The business relationship edges associated with department layer nodes are matched with the transaction amount field to obtain department-level approval process entries in the permission rule table, generating condition judgment logic for triggering approval based on the transaction amount threshold. The semantic relationship edges associated with public layer nodes are matched with the non-sensitive tag fields to obtain public layer query permission entries in the permission rule table, generating an open data query interface. The retention rules for cross-layer relationship edges are converted into cross-layer access permission verification logic. For example, core layer user entities must satisfy both core layer and department layer permission verification when accessing department layer sub-department nodes. The permission policy code segment integrates hierarchical label constraints and attribute field conditions to generate a programmable permission policy code library.

[0049] S4.2. The PBFT consensus algorithm is used to perform distributed verification and contract deployment among blockchain nodes, generating an immutable access control contract address on the blockchain.

[0050] Specifically, programmable permission policy code segments are input into the blockchain node network. The master node packages the permission policy code segments into transaction proposals and broadcasts them to participating nodes. Nodes execute the three-stage process of pre-preparation, preparation, and submission of the PBFT consensus algorithm to verify whether the permission policy code segments meet the constraints of the pre-set permission rule table, such as verifying whether the core layer access control conditions include department-level coding verification logic. During the verification process, if more than two-thirds of the nodes confirm the compliance of the code segment logic (e.g., at least 3 out of 4 nodes pass the verification), the transaction proposals are sorted and blocks are generated. The block hash value is linked to the blockchain ledger through a Merkle tree structure, and the permission control contract is deployed to the blockchain execution environment, generating a contract address based on the hash value. The contract address and deployment timestamp are recorded in the blockchain state tree, generating an immutable permission control contract address.

[0051] S4.3. Hash-bind the immutable access control contract address with the version identifier of the hierarchical knowledge graph and update it to the blockchain node storage to obtain the distributed access control contract corresponding to the hierarchical knowledge graph.

[0052] Specifically, the immutable access control contract address and the version identifier of the hierarchical knowledge graph (e.g., timestamp format 2023-01-01_001) are concatenated and input into the SHA-256 hash function to generate a binding hash value. The binding hash value is broadcast and verified among blockchain nodes through the PBFT consensus algorithm. Nodes verify the integrity of the hash input value and the validity of the version identifier, such as verifying whether the version identifier matches the latest snapshot of the knowledge graph. After more than two-thirds of the nodes confirm the validity of the hash binding, the binding record is written to the transaction log of the blockchain ledger and distributed to the nodes. For example, in the LevelDB storage engine, the key of the key-value pair is the hierarchical knowledge graph version identifier, and the value is the contract address hash. The binding relationship between the access control contract address and the version identifier of the hierarchical knowledge graph is indexed through a Merkle tree structure to generate the distributed access control contract corresponding to the hierarchical knowledge graph.

[0053] S5. Verify user identity using the BGW protocol, use a graph traversal algorithm to query the access path from the hierarchical knowledge graph, and output the access authorization token.

[0054] S5.1 Input the user identity credentials into the BGW protocol, verify their authenticity through multi-party security methods, and starting from the verified user, use a graph traversal algorithm with permission constraints in the layered knowledge graph, input the distributed permission control contract, perform access path edge weight aggregation and cross-layer edge filtering, and output the access path set.

[0055] Specifically, user identity credentials, such as digital certificates and role tags, are input into the BGW protocol participating nodes. The participating nodes shard and encrypt the credentials and broadcast them to other nodes. The nodes perform a multi-party secure computation method to verify the authenticity of the credentials: the hash value of the user's digital certificate is compared with the hash of the credentials registered in the distributed access control contract, and the role tags, such as "financial manager", are matched with the predefined list of permission roles in the contract. After more than half of the nodes confirm that the credentials are valid, a verification pass mark is generated. The verified user entity serves as the starting point for graph traversal. A graph traversal algorithm with permission constraints loads the topology of the hierarchical knowledge graph. During traversal, the distributed permission control contract is accessed to query the current user's hierarchical tag. For example, core-level users are only allowed to access membership edges with an edge weight ≥ 0.8. The edge weights are accumulated along the traversal path; for example, the edge weight from user node to department node is 0.6, and from user node to transaction node is 0.9, resulting in a cumulative weight of 1.5. Cross-level edge filtering rules call the cross-level permission verification function in the contract. For example, a core-level user accessing a department-level node must have a cumulative weight ≥ 1.0 and a cross-level edge weight ≥ 0.7. Paths meeting these conditions are added to the access path set. The traversal terminates when the maximum depth is reached, for example, 5 hops, and the access path set is output.

[0056] S5.2. Based on the edge weights of the access path set and the distributed permission control contract, perform permission aggregation and dynamic allocation of validity periods to generate access authorization tokens with validity periods and operational scope.

[0057] Specifically, by analyzing the edge weight distribution characteristics of historical access paths and combining them with the permission level classification standards set by business security requirements, weight threshold rules are generated. The cumulative edge weight values ​​of the access path set are input into the permission aggregation process. The permission aggregation process matches the weight threshold rules in the distributed permission control contract. For example, a core layer path with a weight ≥ 1.0 can be aggregated into a high-level permission. The permission level is divided according to the cumulative value range. For example, 1.0-2.0 is a basic permission, and 2.0-3.0 is a high-level permission. The time-sensitive dynamic allocation process extracts the effective timestamp of the time-related edges in the access path set. For example, the supply chain operation timestamp is 2023-01-01 10:00:00. Combined with the validity period rules in the distributed permission control contract, for example, the validity period of high-level permissions is 24 hours, the token expiration time is calculated, for example, 2023-01-02 10:00:00. The operation scope definition process traverses the node and edge types of the access path set. Core layer nodes are mapped to core data read / write operations, such as executive user entities; department layer nodes are mapped to department data queries, such as regular transaction data entities; and public layer nodes are mapped to public data read operations, such as non-sensitive contract entities. The access authorization token generation process encodes the permission level, expiration time, and operation scope into structured data, and performs a hash signature using the signature private key of the permission control contract, for example, using the SHA-256 hash value d7a8fbb3, to generate an access authorization token with expiration time and operation scope.

[0058] S6. Encrypt the core layer using an attribute-based encryption strategy, de-identify the departmental layer using differential privacy, and configure the public layer to plaintext to obtain layered protection for enterprise data.

[0059] S6.1. Adopting an attribute-based encryption strategy, the distributed access control contract is parsed to generate the corresponding encrypted public key parameters, which are then used to encrypt the core layer.

[0060] Specifically, the permission level and operation scope fields in the distributed access control contract are input into the key generation algorithm of the attribute-based encryption strategy. The permission level field is converted into an attribute set; for example, high-level permissions are converted into an attribute set containing permissions of "high". The operation scope field is split into operation type attributes; for example, core data read / write is split into an attribute set containing "read" as the operation type and "core" as the scope. The master key generator of the attribute-based encryption strategy generates encrypted public key parameters based on the attribute set; for example, the public key parameters contain hash values ​​for "high permission level" and "read" as the operation type. The core layer data encryption process loads the encrypted public key parameters and matches them with core layer node attributes; for example, for entities with node type "core data". The decryption private key corresponding to the access authorization token holder with high permission level and "read" as the operation scope can decrypt the data. The encryption process converts the core layer node data and edge attributes into ciphertext; for example, the salary field of the executive user entity is converted into ciphertext. Attribute tags are added to the ciphertext; for example, the tag contains "high permission level" and "read" as the operation type. This generates attribute-based encrypted core layer data, completing the encryption of the core layer.

[0061] S6.2 Input the department layer into the differential privacy engine, filter sensitive fields based on the mapping relationship between the hierarchical knowledge graph and the differential privacy parameters, output the desensitized department layer, configure the public layer to plaintext, and merge it with the core layer and department layer to form a hierarchical protection for enterprise data.

[0062] Specifically, the department-level nodes input differential privacy engine, and sensitive field filtering rules map the edge weights and node attributes of the hierarchical knowledge graph: Laplace noise is added to the transaction amount field, for example, an amount of 10,000 yuan becomes 9,850 yuan after adding noise, and the noise amount is based on the edge weight and sensitivity parameters, for example, an edge weight of 0.5 corresponds to a privacy budget ε=0.1; the user contact information field is generalized to the department-level code, for example, the mobile phone number 13800138000 is generalized to the department code D001, and the generalization rule matches the department identifier in the department-level node attributes; the transaction frequency field is truncated, for example, 15 monthly transactions are truncated to the range of 10-20 times, and the truncation threshold is set according to the 90th percentile of the historical monthly transaction frequency data distribution, for example, if it exceeds 30 times, it is truncated to 30+; the desensitized department-level nodes retain non-sensitive fields, such as the product category code HS6110, and the edge data of the department-level nodes retains the weight and type but removes the timestamp details, for example, the business-related edge weight of 0.7 is retained, and the timestamp 2023-01-01 is removed. Public layer nodes and edge data directly retain their plaintext state. For example, the public product code entity is stored as product A, and the contract number is displayed in plaintext. The merging process integrates the core layer encrypted data, the anonymized department layer data, and the plaintext public layer data according to hierarchical labels. The node ID and edge type maintain the original knowledge graph structure. For example, the core layer user entity ID_U1, the anonymized department layer transaction entity ID_T1, and the public layer product entity ID_P1 are connected through the original edge relationship to generate hierarchical protected enterprise data.

[0063] S7. Control the hierarchical protection of enterprise data output through access authorization tokens, and obtain enterprise data after hierarchical and hierarchical authorization.

[0064] S7.1 Parse the ECDSA signature of the access authorization token using an asymmetric signature verification algorithm, verify its validity using the public key parameter, and output the access authorization token content after decryption.

[0065] Specifically, the access authorization token's ECDSA signature input is an asymmetric verification algorithm, splitting the signature value into r and s components; the public key parameter is extracted from the distributed access control contract, for example, the public key parameter is the hexadecimal string 04a3b…; the verification process inputs the hash value of the original access authorization token and the r and s components into an elliptic curve digital signature algorithm verification function to calculate whether the point coordinates match the curve points corresponding to the public key parameters; after successful verification, the decryption process uses the decryption key bound to the access control contract, such as an AES-256 key, to decrypt the token ciphertext, for example, the encrypted field "permission_level:high" is decrypted into the plaintext "high-level permissions"; the output process structurally concatenates the decrypted permission level field (e.g., high-level permissions), operation scope field (e.g., core data read / write), and expiration field (e.g., 2023-01-02 10:00:00) to generate the plaintext content of the access authorization token, for example, the permission level field is high-level permissions, the operation scope field is core data read / write, and the expiration field is the expiration time 2023-01-02. 10:00:00.

[0066] S7.2. Based on access authorization token content control, hierarchical protection of enterprise data output is obtained, resulting in enterprise data after hierarchical and hierarchical authorization.

[0067] Specifically, the access authorization token content includes fields such as permission level (e.g., high-level permissions) matching the core layer encrypted attributes of enterprise data for hierarchical protection. Tags include permission level and operation type. The authorized decryption private key decrypts core layer data, such as the salary field of a senior executive user entity, into plaintext. Operation scope fields include fields such as filtering and anonymizing department layer nodes and edge data for department data queries. Transaction amount fields display a noisy value (e.g., 9850 yuan), user contact information displays a generalized department code (e.g., D001), and transaction count fields retain a range (e.g., 10-20 times). Expiration fields include fields such as expiration time (e.g., 2023-01-02 10:00:00) to verify if the current timestamp is within the validity period; expired access paths are automatically blocked. Public layer data is directly output in plaintext (e.g., product A and contract number in plaintext). The merging process integrates the decrypted core layer, anonymized department layer, and plaintext public layer enterprise data, preserving node relationships according to the original knowledge graph topology (e.g., core layer user entity ID_U1 and department layer transaction entity ID_T1 are connected through business-related edges), generating hierarchical and weighted enterprise data.

[0068] This embodiment also provides a computer device applicable to the blockchain-based distributed enterprise data hierarchical and decentralized service management method, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the blockchain-based distributed enterprise data hierarchical and decentralized service management method proposed in the above embodiment. The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0069] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the blockchain-based distributed enterprise data hierarchical and decentralized service management method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0070] In summary, this invention achieves the following: 1) Dynamically analyzes the relationships between enterprise data entities using graph neural networks to construct a hierarchical knowledge graph, enabling automatic adjustment of enterprise data sensitivity in response to business changes; 2) Enhances the disaster recovery capabilities and consistency of permission policies through a blockchain-based distributed design, while retaining key business chains in the data hierarchy, balancing data security and business logic; 3) Provides verifiable and tamper-proof permission auditing and tracing capabilities by hash-binding contract addresses with knowledge graph versions; and 4) Improves the automation level and operational efficiency of enterprise data management, providing a secure and reliable foundation for cross-departmental collaboration and enterprise data sharing.

[0071] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for distributed enterprise data hierarchical decentralization service management based on blockchain, characterized in that, include: Real-time collection of multi-source heterogeneous data from enterprises, preprocessing of the multi-source heterogeneous data, and extraction of multi-dimensional management entities through NLP entity recognition methods to construct a knowledge graph; Based on knowledge graphs, we analyze the multi-dimensional relationship between management entities through graph neural networks, and use a rule engine to divide the knowledge graph into core, departmental, and public layers. By using smart contract programming to convert hierarchical tags into permission policies, and using the PBFT consensus algorithm to deploy them to blockchain nodes, a distributed permission control contract is obtained. The BGW protocol is used to verify the user's identity, and a graph traversal algorithm is used to query the access path from the hierarchical knowledge graph and output the access authorization token. The core layer is encrypted using an attribute-based encryption strategy, and the departmental layer is de-identified using differential privacy. The public layer is configured to be in plaintext, thus obtaining layered protection for enterprise data. Access authorization tokens control hierarchical protection of enterprise data output, allowing access to enterprise data after hierarchical and decentralized access control. 2.The blockchain-based distributed enterprise data tiered and decentralized service management method of claim 1, wherein, The enterprise's multi-source heterogeneous data includes financial transaction record data, product code data, user relationship data, contract document data, supply chain log data, and surveillance video data; The preprocessing includes removing duplicate and outlier values, filling in missing values, standardizing timestamp formats, and marking sensitive data. 3.The blockchain-based distributed enterprise data tiered and decentralized service management method of claim 2, wherein, The process of extracting multi-dimensional management entities and constructing a knowledge graph using NLP entity recognition methods is as follows: Based on preprocessed multi-source heterogeneous enterprise data, NLP entity recognition methods are used to extract user entities, enterprise data entities, and business entities to obtain multi-dimensional management entities. Based on multi-dimensional management entities, a graph database modeling method is used to perform semantic analysis and establish the hierarchical relationships and business associations between multi-dimensional management entities; The Louvain algorithm is used to calculate the weights of membership and business associations, and density clustering is performed with the business associations to construct a knowledge graph with timestamps. 4.The method of claim 3, wherein, The method, based on knowledge graphs, analyzes multi-dimensional entity relationships using graph neural networks and employs a rule engine to divide the data into core, departmental, and public layers, generating a hierarchical knowledge graph. The specific steps are as follows: Based on historical multi-dimensional management entities, a graph neural network is trained using a semi-supervised graph representation learning method; The multi-dimensional management entities are input into the trained graph neural network, and feature fusion and relationship enhancement are performed through node embedding and edge weight propagation algorithms to generate edge weights for the multi-dimensional management entity association. Based on the edge weights of multi-dimensional management of entity association, a rule engine is used to perform multi-dimensional quantitative evaluation through predefined sensitivity judgment rules, generate triples with hierarchical labels, and reconstruct the knowledge graph topology. The core layer, department layer and public layer are divided according to hierarchical labels and mapped to independent subgraph spaces respectively. At the same time, cross-layer association edges are retained to generate a hierarchical knowledge graph. 5.The blockchain-based distributed enterprise data tiered-decentralized service management method of claim 4, wherein, The specific steps for using smart contract programming to convert hierarchical tags into permission policies and deploying them to blockchain nodes using the PBFT consensus algorithm to obtain a distributed permission control contract are as follows: The triplet hierarchical labels in the hierarchical knowledge graph are input into the smart contract compiler and converted into programmable permission policy code segments through a pre-defined permission rule table; The PBFT consensus algorithm is used to perform distributed verification and contract deployment among blockchain nodes, generating an immutable permission control contract address on the blockchain. The immutable access control contract address is hash-bound to the version identifier of the hierarchical knowledge graph and updated to the blockchain node storage to obtain the distributed access control contract corresponding to the hierarchical knowledge graph.

6. The blockchain-based distributed enterprise data hierarchical and decentralized service management method as described in claim 5, characterized in that, The steps for verifying user identity using the BGW protocol, retrieving the access path from the hierarchical knowledge graph using a graph traversal algorithm, and outputting an access authorization token are as follows: User identity credentials are input into the BGW protocol, and their authenticity is verified through multiple security methods. Starting with verified users, a graph traversal algorithm with permission constraints is used in the layered knowledge graph. The distributed permission control contract is input to perform access path edge weight aggregation and cross-layer edge filtering, and the access path set is output. Based on the edge weights of the access path set and the distributed permission control contract, permission aggregation and dynamic allocation of validity periods are performed to generate access authorization tokens with validity periods and operational scope.

7. The blockchain-based distributed enterprise data hierarchical and decentralized service management method as described in claim 1, characterized in that, The core layer is encrypted using an attribute-based encryption strategy, and the departmental layers are de-identified using differential privacy. The public layer is configured to be in plaintext, thus obtaining layered protected enterprise data. The specific steps are as follows: An attribute-based encryption strategy is adopted to parse the distributed access control contract to generate the corresponding encrypted public key parameters, and then encrypt the core layer. The department layer is input into the differential privacy engine, which filters sensitive fields based on the mapping relationship between the hierarchical knowledge graph and the differential privacy parameters, outputs the de-identified department layer, configures the public layer to plaintext, and merges it with the core layer and department layer to form a hierarchical protection for enterprise data.

8. The blockchain-based distributed enterprise data hierarchical and decentralized service management method as described in claim 7, characterized in that, The specific steps for controlling hierarchical protection of enterprise data output through access authorization tokens and obtaining enterprise data after hierarchical and decentralized access are as follows: The access authorization token's ECDSA signature is parsed using an asymmetric signature verification algorithm, its validity is verified using the public key parameter, and the content of the access authorization token is output after decryption. Based on access authorization tokens, content control layers protect enterprise data output, resulting in enterprise data that has been layered and authorized.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the blockchain-based distributed enterprise data hierarchical and decentralized service management method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the blockchain-based distributed enterprise data hierarchical and decentralized service management method as described in any one of claims 1 to 8.

Images