Blockchain-based ICT technical service work order credible evidence storage method and system

Abstract

The application provides a blockchain-based ICT technical service work order credible storage method and system, and relates to the technical field of blockchain data processing.The method comprises the following steps: extracting the continuous flow node timestamp sequence of the ICT work order in the distributed ledger, measuring the period-by-period difference value of adjacent node timestamps to obtain a time interval change quantity sequence; mapping each flow node in the time interval change quantity sequence and the corresponding block height state hash transition quantity to a two-dimensional phase plane to obtain a set of discrete coordinate points; along the two-dimensional phase plane, the boundary shrinkage range is explored point by point, the minimum enclosing circle covering all discrete coordinate points is calculated, and a target coordinate point set located on the boundary of the minimum enclosing circle is extracted.The application improves the abnormal troubleshooting efficiency of work order storage data in the distributed ledger environment.

Description

Technical Field

[0001] This invention relates to the field of blockchain data processing technology, and in particular to a blockchain-based method and system for trusted storage of ICT service work orders. Background Technology

[0002] Existing blockchain-based ICT service work order management solutions typically rely on the unidirectional linking characteristic of block hash chains to ensure the immutability of data stored within a single block. This is achieved by pointing the block header hash value of the subsequent block to the previous block, forming a chain-like anti-tampering structure.

[0003] This block-by-block verification mechanism can only detect whether data changes have occurred at the level of a single block. It is difficult to detect continuous multi-node collaborative tampering behavior that occurs during the segmented transmission of ICT work orders across multiple flow nodes. When an attacker tampers with the work order data and then synchronously recalculates the state hash value of the node and its subsequent nodes to maintain the local consistency of the chain hash, relying on block-by-block hash verification will fail to identify anomalies in the flow path. As a result, although the distributed ledger records a complete flow log, it lacks the ability to automatically identify and reliably store abnormal flow segments throughout the flow process, thus making the storage results unreliable at the flow process level. Summary of the Invention

[0004] This invention provides a blockchain-based method and system for trusted storage of ICT service work orders, which improves the efficiency of anomaly detection for work order data in a distributed ledger environment.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: Firstly, a blockchain-based method for trusted storage of ICT service work orders, the method comprising: Step 1: Extract the timestamp sequence of continuous flow nodes of ICT work orders in the distributed ledger, calculate the period-by-period difference of the timestamps of adjacent nodes, and obtain the time interval change sequence. Step 2: Map the state hash transition of each flow node and the corresponding block height within the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points; Step 3: Explore the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum enclosing circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum enclosing circle; Step 4: Divide the flow path into smooth flow segments based on the target coordinate point set, and divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into abrupt change suspicious segments. Step 5: Within the suspected mutation segment, accumulate the difference in the state hash values ​​of adjacent nodes along the increasing direction of block height to obtain the total cumulative offset within the segment that reflects the degree of tampering. Step 6: Compare the total cumulative offset within the segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly judgment result; Step 7: In response to the evidence storage anomaly determination result, encapsulate the underlying original operation log and discrete coordinate point set corresponding to the mutation suspicious segment to obtain the evidence storage data packet to be uploaded to the chain. Step 8: Utilize the underlying consensus mechanism of the distributed ledger to broadcast the data packet to be stored on the chain, obtain a trusted storage certificate with a block identifier, and return the trusted storage certificate to the work order initiating terminal to complete the complete trusted storage loop of the ICT technical service work order on the distributed ledger.

[0006] Secondly, a blockchain-based trusted evidence storage system for ICT technology service work orders includes: The timestamp extraction and calculation module is used to extract the timestamp sequence of continuous flow nodes of ICT work orders in the distributed ledger, calculate the period-by-period difference of the timestamps of adjacent nodes, and obtain the time interval change sequence. The phase plane mapping module is used to map the state hash transition of each flow node and the corresponding block height in the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points. The minimum bounding circle calculation module is used to explore the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum bounding circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum bounding circle. The flow path division module is used to divide the flow path into smooth flow segments based on the target coordinate point set, and to divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into abrupt change suspicious segments. The total offset calculation module is used to accumulate the difference of the state hash values ​​of adjacent nodes along the increasing direction of block height within a suspected mutation segment, so as to obtain the total cumulative offset within the segment that reflects the degree of tampering. The evidence storage anomaly determination module is used to compare the total cumulative offset within a segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly determination result. The evidence storage data encapsulation module is used to encapsulate the underlying original operation log and discrete coordinate point set corresponding to the mutation suspicious segment in response to the evidence storage anomaly judgment result, and obtain the evidence storage data packet to be uploaded to the chain. The on-chain broadcast and credential return module is used to broadcast the data packets to be stored on the blockchain using the underlying consensus mechanism of the distributed ledger, obtain trusted credentials with block identifiers, and return the trusted credentials to the work order initiating terminal, thus completing the complete trusted credential storage loop of ICT technical service work orders on the distributed ledger.

[0007] The above-described solution of the present invention has at least the following beneficial effects: By jointly mapping the change in the time interval between flow nodes and the state hash transition to a two-dimensional phase plane, and automatically dividing the flow path into smooth flow segments and suspected mutation segments based on the minimum enclosing circle algorithm, spatial geometric detection of tampering behavior during the cross-node flow of ICT work orders is realized. By accumulating the state hash difference value along the block height direction in the suspected mutation segment, the total cumulative offset within the segment that can be quantified and compared is obtained, which solves the technical problem that existing technologies cannot quantitatively assess the degree of tampering in the flow process. When an evidence storage anomaly is detected, the underlying original operation log and discrete coordinate point set are automatically encapsulated and stored on the blockchain through the distributed ledger consensus mechanism, so that the full operation evidence of the abnormal flow segment is immutably solidified on the blockchain, ultimately forming a complete and credible evidence storage closed loop covering the entire flow process. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating a blockchain-based ICT technology service work order trusted evidence storage method provided in an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of a blockchain-based ICT technology service work order trusted evidence storage system provided by an embodiment of the present invention. Detailed Implementation

[0010] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art.

[0011] like Figure 1 As shown, embodiments of the present invention propose a blockchain-based method for trusted storage of ICT technology service work orders, the method comprising the following steps: Step 1: Extract the timestamp sequence of continuous flow nodes of ICT work orders in the distributed ledger, calculate the period-by-period difference of the timestamps of adjacent nodes, and obtain the time interval change sequence. Step 2: Map the state hash transition of each flow node and the corresponding block height within the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points; Step 3: Explore the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum enclosing circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum enclosing circle; Step 4: Divide the flow path into smooth flow segments based on the target coordinate point set, and divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into abrupt change suspicious segments. Step 5: Within the suspected mutation segment, accumulate the difference in the state hash values ​​of adjacent nodes along the increasing direction of block height to obtain the total cumulative offset within the segment that reflects the degree of tampering. Step 6: Compare the total cumulative offset within the segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly judgment result; Step 7: In response to the evidence storage anomaly determination result, encapsulate the underlying original operation log and discrete coordinate point set corresponding to the mutation suspicious segment to obtain the evidence storage data packet to be uploaded to the chain. Step 8: Utilize the underlying consensus mechanism of the distributed ledger to broadcast the data packet to be stored on the chain, obtain a trusted storage certificate with a block identifier, and return the trusted storage certificate to the work order initiating terminal to complete the complete trusted storage loop of the ICT technical service work order on the distributed ledger.

[0012] In this embodiment of the invention, by mapping the time interval change of the flow nodes to the state hash transition amount to a two-dimensional phase plane, the geometric constraint of the minimum enclosing circle is used to eliminate normal business fluctuation data, accurately stripping out suspicious segments of mutations that deviate from the normal flow trajectory, and eliminating the interference of the regular work order flow rhythm on anomaly investigation; within the suspicious segment of mutation, the difference of the state hash value of adjacent nodes is accumulated one by one, and the discrete hash jumps are converted into the total cumulative offset, realizing the numerical quantification of the degree of work order data tampering; finally, the underlying original operation log and discrete coordinate point set are jointly encapsulated and broadcast on the chain, constructing a complete evidence storage link containing physical operation records and geometric feature evidence, ensuring the traceability and non-repudiation of the anomaly judgment results, and improving the anomaly investigation efficiency and anti-tampering reliability of work order evidence storage data in the distributed ledger environment.

[0013] In a preferred embodiment of the present invention, step 1 above may include: Step 11: Based on the flow records of ICT work orders within each block of the distributed ledger, extract the block header timestamp field of the block where each flow node completed processing. Arrange the timestamps of each flow node in ascending order of block height to obtain a continuous flow node timestamp sequence. Specifically, this includes: locating all block records corresponding to the unique identifier of the ICT work order in the distributed ledger; using the work order identifier as the index key, traversing all blocks on the blockchain from the work order creation block to the work order closure block; and for each traversed block, reading the timestamp field stored in the block header data structure. This timestamp field is in UNIX timestamp format with millisecond precision. It records the network time when the block was generated by the consensus node. All extracted timestamps are arranged in ascending order of their respective block heights. The block height is the sequential number of each block on the blockchain starting from the genesis block. The genesis block has a height of 0, and the height of each subsequent new block increases by 1 based on the height of the previous block. The arranged sequence is denoted as the continuous flow node timestamp sequence. .

[0014] Step 12: Based on the continuous flow node timestamp sequence, calculate the difference between the timestamp of the next node and the timestamp of the previous node in turn to obtain the flow time interval between every two adjacent flow nodes. Arrange the flow time intervals in the order of flow occurrence to obtain the flow time interval sequence between adjacent nodes. Specifically, this includes: processing the obtained continuous flow node timestamp sequence... Starting from the second element, subtract the value of the previous element from the value of the next element to obtain the sequence of time intervals between adjacent nodes. .

[0015] Step 13: Based on the sequence of adjacent node transition time intervals, calculate the difference between the next transition time interval and the previous transition time interval sequentially to obtain the segmented change between each adjacent time interval. Arrange the segmented changes in the order of transition to obtain the sequence of time interval changes. Specifically, this includes: processing the obtained sequence of adjacent node transition time intervals... Starting from the second element, subtract the value of the previous element from the value of the next element to obtain the segmented change between adjacent time intervals. .

[0016] In this embodiment of the invention, by extracting the immutable timestamp field from the underlying block header of the blockchain and strictly sorting it according to the block height, the objective authenticity and tamper-proof properties of the transfer time data are ensured. On this basis, by calculating the absolute transfer time between adjacent nodes to characterize the business processing rhythm, and further calculating the difference between adjacent time intervals to extract the second-order change characteristics of the transfer rhythm, the invention can keenly capture the small fluctuations and sudden changes in time consumption caused by human intervention, system anomalies or malicious tampering during the work order transfer process, thereby improving the accuracy of evidence storage anomaly investigation.

[0017] In a preferred embodiment of the present invention, step 2 above may include: Step 21: Based on the transition nodes corresponding to each element in the time interval change sequence, obtain the Merkle root hash value of the block where each transition node is located from the distributed ledger. Perform a bitwise XOR operation between the Merkle root hash value of each transition node and the Merkle root hash value of the previous transition node to obtain the state hash transition amount corresponding to each transition node. Specifically, this includes: based on the time interval change sequence... Each element in the process retrieves its corresponding Merkle root hash value from the distributed ledger, representing the state of the block it belongs to. The Merkle root hash value is stored in the `stateRoot` field of each block header. This field is a 32-byte hexadecimal string, calculated from the Merkle root hash value of the global state after all transactions within the block have been executed. A bitwise XOR operation is then performed between the Merkle root hash value of each transit node and the Merkle root hash value of the previous transit node. For the first The 256-bit unsigned integer corresponding to the Merkelgen hash value of the block where the _th circulation node is located, then the _th The state hash transition amount corresponding to each circulation node The calculation method is as follows: ; in, This indicates a bitwise XOR operation. The value is For the first transfer node The Merklegen hash value of the predecessor node is taken from the Merklegen hash value of the latest confirmed block before the work order was created.

[0018] The 256-bit binary result obtained by the XOR operation is converted into a decimal unsigned integer. This integer value is the state hash transition value. The magnitude of the state hash transition value reflects the degree of difference in the global state hash value between two adjacent flow nodes. Due to the avalanche effect of cryptographic hash functions, any state change will cause drastic and unpredictable changes in the hash value: when the work order processing operation between two flow nodes only involves local state changes, the state hash transition value is a relatively small value; when a large amount of state data is written or modified between two flow nodes, the state hash transition value corresponds to a relatively large value.

[0019] Step 22: Based on the values ​​of each element in the time interval change sequence and the state hash transition values ​​corresponding to each transition node, map each transition node to a two-dimensional phase plane one by one, using the time interval change as the horizontal axis coordinate value and the state hash transition value as the vertical axis coordinate value, to obtain a discrete coordinate point set. Specifically, this includes: mapping the obtained time interval change sequence... The values ​​of each element in the data are compared with the state hash transition values ​​corresponding to each flow node. Perform one-to-one pairing, based on the change in time interval. As the horizontal axis coordinate value, corresponding to the state hash transition amount Using the vertical axis coordinate value, each flow node is mapped one by one to the two-dimensional phase plane, forming discrete coordinate points, where That is, the first The change in the time interval corresponds to the first... The first circulation node to the first The change characteristics between the flow nodes, and the flow node associated with these change characteristics is the th flow node. There are 1 flow nodes, and the resulting discrete coordinate points are denoted as _ . All discrete coordinate points constitute a discrete coordinate point set. The horizontal axis of the two-dimensional phase plane represents the changing trend of the time interval between transactions, and the vertical axis represents the change range of the global state of the blockchain. When the transaction process is stable and normal, the discrete coordinates of each transaction node tend to cluster in a finite area of ​​the two-dimensional phase plane, forming a clustered distribution; when abnormal behavior occurs during the transaction process, the corresponding discrete coordinates appear as free points deviating from the clustered area on the two-dimensional phase plane.

[0020] In this embodiment of the invention, by extracting the Merkle hash value of the block state and performing bitwise XOR operations, the subtle changes in the underlying data between adjacent flow nodes are accurately quantified, achieving efficient and sensitive capture of work order state transitions. At the same time, the time interval change representing the change in time rhythm and the state hash transition representing the change in data are respectively mapped to the two-dimensional phase plane as horizontal and vertical coordinates, realizing the cross-domain feature fusion of the time dimension and the data dimension, transforming the one-dimensional sequence into a two-dimensional spatial distribution, intuitively and comprehensively representing the spatiotemporal evolution law of work order flow, and improving the dimension and accuracy of evidence anomaly investigation.

[0021] In a preferred embodiment of the present invention, step 3 above may include: Step 31: Based on the set of discrete coordinate points, arbitrarily select three non-collinear discrete coordinate points on the two-dimensional phase plane. Determine an initial circumcircle based on the three discrete coordinate points. Detect whether there are any discrete coordinate points on the two-dimensional phase plane located outside the initial circumcircle to obtain the detection result. Specifically, this includes: from the set of discrete coordinate points... If we arbitrarily select three non-collinear discrete coordinate points, the criterion for determining whether the three points are collinear is: Let the three selected discrete coordinate points be... , , Calculate the directed area of ​​the triangle formed by these three points. The method for calculating the directed area is as follows: ; when When the absolute value of is 0, the three points are collinear; when When the absolute value of is not 0, the three points are not collinear. If the three selected points are collinear, they are randomly selected again until three non-collinear discrete coordinate points are obtained. An initial circumcircle is determined based on the three non-collinear discrete coordinate points, and the center coordinates of the circumcircle are denoted as . The radius is denoted as The circumcenter of the circle is the circumcenter of the triangle formed by the three points, and its coordinates are calculated by the intersection of the perpendicular bisectors of the two sides. Specifically, let... and The midpoint of the line is , and The midpoint of the line is ,but: ; ; The slope of the connecting line is The slope of its perpendicular bisector is ; The slope of the connecting line is The slope of its perpendicular bisector is The intersection of the two perpendicular bisectors is the center of the circumcircle. .

[0022] Once the center is determined, the radius... The calculation method is the Euclidean distance from the center of the circle to any vertex: ; Traversing the discrete coordinate point set Each discrete coordinate point in ,calculate Euclidean distance to the center of the initial circumcircle : ; If there exists any discrete coordinate point Make Greater than If so, then it is determined that there exists a discrete coordinate point located outside the initial circumcircle.

[0023] Step 32: Based on the detection results, when there are discrete coordinate points located outside the initial circumcircle, the initial circumcircle is taken as the current circumcircle. The boundary of the current circumcircle is expanded outward to include the discrete coordinate points outside. The center position and radius of the circumcircle are re-determined based on the expanded set of covered points. The boundary expansion operation is repeated until there are no discrete coordinate points outside the circumcircle on the two-dimensional phase plane, resulting in the smallest enclosing circle covering all discrete coordinate points. Specifically, when the detection results indicate that there are discrete coordinate points outside the initial circumcircle, the initial circumcircle is taken as the current circumcircle, and the boundary expansion iteration process is initiated. The specific steps of the boundary expansion iteration process are as follows: From all discrete coordinate points located outside the current circumcircle, select the discrete coordinate point farthest from the center of the current circumcircle, and denote it as... ,Will The set of points covered by the circumcircle is included, with the constraint that all discrete coordinate points within the set lie inside or on the boundary of the circumcircle. Along... The direction in which the current circumcircle is extended is the boundary of the expanded circumcircle. The center of the expanded circumcircle starts from the original center and points towards the direction of the original center. The vector moves in the direction of the vector, and the distance moved is... The expanded circumcircle radius is updated to... ,in for The distance to the original center. The radius of the original circumcircle.

[0024] Using the expanded circumcircle as the new current circumcircle, traverse the discrete coordinate point set again. For the discrete coordinate points that have not yet been covered, check if there are still discrete coordinate points located outside the new current circumcircle, and repeat the above steps until the set of discrete coordinate points has been traversed. After this, there are no discrete coordinate points located outside the current circumcircle. The current circumcircle at this point is the smallest enclosing circle encompassing all discrete coordinate points, and its center is denoted as . The radius is denoted as .

[0025] The convergence of the boundary expansion iterative process is guaranteed by the finiteness of the covered point set: discrete coordinate point set. At most contains Given a set of discrete coordinate points, each iteration includes at least one external discrete coordinate point within the coverage area, therefore the number of iterations does not exceed [number missing]. Second-rate.

[0026] Step 33: Based on the minimum enclosing circle, extract all discrete coordinate points traversed by the circumference of the minimum enclosing circle to obtain the set of target coordinate points located on the boundary of the minimum enclosing circle. Specifically, this includes: traversing the set of discrete coordinate points based on the obtained minimum enclosing circle. Each discrete coordinate point in ,calculate Euclidean distance to the center of the smallest enclosing circle Each discrete coordinate point corresponding distance With the minimum enclosing circle radius The ratio is denoted as ; Set the boundary judgment tolerance, with a value of ,when satisfy At that time, the judgment Located on the circumferential boundary of the smallest enclosing circle, it is included in the set of boundary coordinate points; when satisfy At that time, the judgment Located inside the smallest enclosing circle; when satisfy At that time, the judgment It is located outside the smallest enclosing circle.

[0027] Extracting satisfaction All discrete coordinate points constitute the set of target coordinate points located on the boundary of the smallest enclosing circle. .

[0028] In this embodiment of the invention, the minimum enclosing circle covering all discrete coordinate points is adaptively solved by iteratively expanding the circumscribed circle boundary. A compact geometric envelope is dynamically fitted based on the actual distribution of work order flow data in the two-dimensional phase plane, effectively avoiding the subjectivity and scenario limitations caused by manually setting fixed thresholds. At the same time, by accurately extracting the set of target coordinate points located on the circumference of this minimum enclosing circle, the extreme boundary features of the normal flow state in terms of time rhythm and data change dimension are locked, improving the adaptive capability and boundary definition accuracy of abnormal flow area division.

[0029] In a preferred embodiment of the present invention, step 4 above may include: Step 41: Based on the set of target coordinate points, determine the position of the corresponding flow node on the flow path for each target coordinate point, and divide the continuous flow node interval between two adjacent target coordinate points on the flow path into smooth flow segments. Specifically, this includes: based on the obtained set of target coordinate points... Determine the set of target coordinate points The location of each target coordinate point on the flow path corresponds to a flow node position. The correspondence between the flow node position and the discrete coordinate point is as follows: Discrete coordinate point Corresponding to the There are several flow nodes. Therefore, for the target coordinate point set... Each target coordinate point Its location as a flow node on the flow path is ,in for In the discrete coordinate point set The original index in the target coordinate point set The coordinates of each target point are arranged in ascending order of the position of the flow node along the flow path. Let the sequence of the flow node positions be . ,in .

[0030] For the first in the flow path The first circulation node to the first The continuous flow node interval between flow nodes ( The entire flow path segment corresponding to all flow nodes in the interval is divided into a smooth flow segment. The characteristics of a smooth flow segment are: all discrete coordinate points within the segment are clustered inside or near the boundary of the minimum enclosing circle; the time interval changes and state hash transitions between flow nodes remain within normal fluctuation ranges without abnormal deviations; and the starting point of each smooth flow segment is the [missing information - likely a specific node or node]. The nth flow node, the endpoint is the nth flow node. There are 10 flow nodes, and the number of flow nodes contained in a segment is 10. .

[0031] Step 42: Based on the relative positional relationship between the discrete coordinate point set and the minimum enclosing circle, identify the free coordinate points outside the boundary of the minimum enclosing circle, determine the position of the flow node corresponding to each free coordinate point on the flow path, and divide the continuous flow node interval containing free coordinate points on the flow path into abrupt change suspicious segments. Specifically, this includes: traversing the discrete coordinate point set. Each discrete coordinate point in The calculated distance ratio As the basis for judgment, identify those that meet the criteria. The discrete coordinate points are marked as free coordinate points. Free coordinate points are discrete coordinate points located outside the boundary of the minimum enclosing circle. Their corresponding flow nodes show an offset relative to the normal flow mode in two dimensions: the change in flow time interval and the state hash transition amount.

[0032] Determine the location of the corresponding flow node on the flow path for each free coordinate point. For free coordinate points... The corresponding flow node position is ,in for In the discrete coordinate point set The original index is used to define the flow node position corresponding to each free coordinate point. Centered on this flow node position, two flow nodes are extended forward and two flow nodes backward along the flow path, forming a continuous flow node interval covering the free coordinate point. When extending forward beyond the first flow node, the first flow node is taken as the starting point of the interval; when extending backward beyond the first flow node... When the first flow node is used, the first Each flow node is used as the endpoint of an interval. The aforementioned continuous flow node intervals are divided into segments suspected of abrupt changes. When multiple free coordinate points correspond to overlapping continuous flow node intervals, the overlapping intervals are merged into a single continuous segment suspected of abrupt changes. The merging rule is: if two continuous flow node intervals... and satisfy Then the two will be merged into The number of suspected mutation segments is denoted as , No. Each mutation-probable segment is denoted as... The starting flow node position is denoted as The location of the termination point is recorded as , The expansion rule is based on the location of the flow node corresponding to each free coordinate point. Taking that flow node location as the center, two flow nodes are extended forward and two backward along the flow path, forming a continuous flow node interval covering that free coordinate point. The basis for determining expansion rule 2 is: through statistical analysis of 1000 sets of simulated collaborative tampering attack test data, when the number of expanded nodes is 2, it covers more than 95% of all nodes involved in collaborative tampering behavior, while controlling the proportion of falsely expanded normal nodes to below 5%. When extending forward beyond the first flow node, the first flow node is taken as the starting point of the interval; when extending backward beyond the first flow node... When the first flow node is used, the first Each flow node is the endpoint of the interval.

[0033] In this embodiment of the invention, by using the target coordinate point on the boundary of the smallest enclosing circle as the natural dividing benchmark, the work order flow path is finely divided into a smooth flow segment and a suspected mutation segment, thus achieving physical isolation between normal business fluctuations and potential abnormal mutations. This adaptive interval division mechanism based on geometric envelope boundaries not only effectively overcomes the defects of false alarms and false alarms that are easily caused by the globally unified threshold, but also improves the objectivity and accuracy of flow status classification, narrows the data processing scope of anomaly investigation, and improves the efficiency and accuracy of ICT work order evidence storage anomaly location while reducing the system's computational complexity.

[0034] In a preferred embodiment of the present invention, step 5 above may include: Step 51: Based on the suspected mutation segment, starting from the initial flow node of the suspected mutation segment, sequentially perform a bitwise XOR operation between the state hash value of the subsequent flow node and the state hash value of the previous flow node along the increasing block height direction to obtain the state hash difference value of each pair of adjacent flow nodes. Specifically, this includes: starting from the suspected mutation segment... The starting flow node Initially, along the increasing block height direction, sequentially extract the Merkle root hash values ​​of the states corresponding to all flowing nodes within the suspected mutation segment. Let the suspected mutation segment be... The sequence number of the internal transfer node is , The value is .

[0035] Suspected mutation segments For each pair of adjacent transition nodes, a bitwise XOR operation is performed between the Merklegen hash value of the state of the subsequent transition node and the Merklegen hash value of the state of the preceding transition node. The bitwise XOR operation is performed as follows: convert the Merklegen hash values ​​of the two transition nodes into 256-bit binary representations, then compare each bit of the two 256-bit binary strings. If corresponding bits are the same, the result for that bit is 0; if corresponding bits are different, the result for that bit is 1. Finally, a 256-bit binary result string is obtained. Let's assume a mutation-prone segment... Inner The first circulation node and the first The state hash difference between each circulation node is... The calculation method is as follows: ; in For the first The Merkelgen hash value of the state of each block in a given flow node is represented by a 256-bit unsigned integer. This is the bitwise XOR operator. The value is .

[0036] Convert the 256-bit binary result obtained by the XOR operation to an unsigned decimal integer; this integer value is... ， The numerical value reflects the degree of bit difference in the state hash values ​​between two adjacent flow nodes: when the state change of the later flow node relative to the earlier flow node is small... It is a small integer value; when the state change of the subsequent transition node relative to the previous transition node is large. Given a large integer value, iterate through the suspected mutation segments one by one. For each pair of adjacent flow nodes within a given segment, obtain the sequence of state hash differences for each pair of adjacent flow nodes. .

[0037] Step 52: Based on the state hash difference values ​​of each adjacent flow node within the suspected mutation segment, sum all state hash difference values ​​to obtain the total cumulative offset within the segment, reflecting the degree of state data tampering within the suspected mutation segment. Specifically, this includes: for each suspected mutation segment... The hash differences of all states within this segment will be obtained. The cumulative offset within the segment is obtained by summing the results.

[0038] The method for calculating the total cumulative offset within a segment is as follows: ; in, Indicates the first The total cumulative offset within each segment of a suspected mutation segment. This represents the summation operator. The value traversal of the suspected mutation segment An index of all adjacent flow node pairs within the node.

[0039] The numerical value has the following physical meaning: In the normal workflow of a work order, the difference in status hash values ​​between each workflow node is caused by the normal business operations of the work order content. The single-segment difference value is relatively stable, and the total cumulative offset... Maintain at a low baseline level; when tampering occurs during the work order process, the tampering operation causes a significant change in the Merkelgen hash value of the status, resulting in the corresponding... An abnormal peak value appeared, which in turn increased the total cumulative offset. Values ​​exceeding the normal baseline will all The total cumulative offset within each segment of a suspected mutation segment is arranged by segment number to obtain the set of total cumulative offsets within segments. .

[0040] In this embodiment of the invention, by performing a bitwise XOR operation on the state hash values ​​of adjacent nodes along the increasing block height within the suspected mutation segment, changes in block state data at the bit level are captured, thus enabling the extraction of traces of underlying data tampering. By summing all the state hash differences, discrete and microscopic hash jumps are transformed into a continuous cumulative offset within the segment, thus achieving numerical quantification of the degree of data tampering within the suspected interval. This mechanism performs targeted quantitative analysis within a narrowed investigation range, avoiding the computational power consumption caused by global calculations and improving the accuracy and computational efficiency of evidence anomaly determination.

[0041] In a preferred embodiment of the present invention, step 6 above may include: Step 61: Based on the total cumulative offset within the segment, compare the value of the total cumulative offset within the segment with the pre-set evidence storage security envelope tolerance to obtain the comparison result. Specifically, this includes: for each segment suspected of mutation... The total cumulative offset within its segment The size is compared with the pre-set evidence storage security envelope tolerance. The setup is as follows: Extract the flow process data of all ICT work orders that have completed trusted notarization within the past 30 natural days from the historical notarization records of the distributed ledger. For the flow path of each historical work order, calculate the state hash difference value between each flow node of the work order according to the method of steps 11 to 52, and take the state hash difference value of all adjacent flow nodes in all historical work orders as a sample set. Sort the sample set from smallest to largest, and take the value at the 95th position as the baseline value. Based on the statistical analysis of 1000 sets of test data of simulated tampering attacks, when the baseline value is multiplied by an empirical coefficient of 5.0, the recall rate of anomaly detection reaches 99.2%, while the false positive rate is less than 0.5%. Therefore, the baseline value is multiplied by 5.0 as the value of the notarization security envelope tolerance.

[0042] When the number of historical work orders within the past 30 calendar days is less than 100, a preset backoff fixed value is used as the evidence storage security envelope tolerance. This backoff fixed value is determined based on statistical analysis of a large amount of normal work order flow data; under tamper-free conditions, the cumulative sum of the state hash differences between adjacent nodes typically does not exceed [a certain threshold]. To ensure a low false alarm rate even with insufficient historical data, a conservative value significantly higher than the normal baseline is adopted. As a fixed value for retreat.

[0043] For each suspected mutation segment The judgment ratio is obtained by calculating the ratio of the evidence preservation security envelope tolerance to the total cumulative offset within the segment of the suspected mutation segment. ; Will As a quantitative indicator for size comparison, it completes the comparison of all... The size comparison of each suspected mutation segment was performed to obtain the size comparison result for each suspected mutation segment. The size comparison result is as follows: The comparison with 1.0, i.e. or .

[0044] Step 62: Based on the size comparison results, if the total cumulative offset within a segment is less than or equal to the evidence preservation security envelope tolerance, it is determined that the segment with the suspected mutation does not have evidence preservation anomalies; if the total cumulative offset within a segment is greater than the evidence preservation security envelope tolerance, it is determined that the segment with the suspected mutation has evidence preservation anomalies, thus obtaining the evidence preservation anomaly determination result, specifically including: based on the obtained size comparison results... For each suspected mutation segment Make separate judgments on the abnormality of the evidence storage, when At that time, that is, the total cumulative offset within the segment. Less than or equal to the evidence preservation security envelope tolerance At that time, the segment suspected of mutation was determined. There are no evidence abnormalities. At this point, the segment with suspected mutation is... The cumulative difference in the state hash values ​​within this segment does not exceed the fluctuation range that can be generated during normal circulation. The state changes of each circulation node within this segment are caused by normal ICT work order business operations and do not require triggering the evidence storage anomaly handling process. At that time, that is, the total cumulative offset within the segment. Greater than the evidence preservation security envelope tolerance At that time, the segment suspected of mutation was determined. There are abnormalities in the evidence, and the mutation segment is suspicious. The accumulated difference in state hash values ​​within this segment exceeds the upper limit of normal fluctuations, indicating a high likelihood of tampering. This necessitates triggering subsequent abnormal evidence encapsulation and on-chain evidence storage processes. After each suspected mutation segment is evaluated, the evaluation results are summarized into a set of evidence anomaly evaluation results. .

[0045] In this embodiment of the invention, a dual verification mechanism is constructed by strictly comparing the total cumulative offset within the segment obtained by quantification with the pre-set evidence storage security envelope tolerance. This mechanism quantifies both geometric feature deviation and the degree of data tampering, providing a clear and objective quantitative standard for determining evidence storage anomalies. This mechanism effectively distinguishes between geometric detachment caused by normal business fluctuations and real data tampering behavior, reduces the false alarm rate of anomaly detection, improves the accuracy of evidence storage anomaly determination, avoids invalid abnormal data from being uploaded to the blockchain, and saves the storage resources of the distributed ledger.

[0046] In a preferred embodiment of the present invention, step 7 above may include: Step 71: Based on the evidence storage anomaly determination results, retrieve the underlying original operation logs corresponding to the transfer nodes covered by the suspected mutation segments from the local storage of each consensus node in the distributed ledger. These underlying original operation logs include the operation type identifier, operation subject identifier, operation trigger timestamp, and snapshots of state data before and after the operation for each transfer node. Specifically, this includes retrieving the obtained evidence storage anomaly determination result set. From these, segments with suspicious mutations that are deemed to have abnormal evidence are selected, i.e., those that meet the criteria... All segments suspected of mutation are identified, and these segments are marked as abnormal flow segments, with their corresponding segment IDs denoted as [the set of segments]. ,for Each abnormal flow segment in The underlying log retrieval request is broadcast to all consensus nodes in the distributed ledger network. The data structure of this retrieval request includes the following fields: unique identifier of the work order, and the starting node position of the abnormal transfer segment. Location of the termination node of the abnormal flow section 1. Retrieve the timestamp of the request initiation.

[0047] After receiving a request to retrieve the underlying logs, each consensus node retrieves the underlying original operation logs that match the request parameters from its local storage. The local storage of the consensus node adopts a key-value database, using a combination of the work order unique identifier and the location of the transfer node as the composite key, and the serialized byte stream of the underlying original operation logs as the value.

[0048] The data fields for each record in the underlying raw operation log include: The operation type identifier is a 2-byte unsigned integer used to distinguish different types of operations during the work order process. Values ​​include 0x0001 for work order creation, 0x0002 for work order data modification, 0x0003 for work order approval, 0x0004 for work order rejection, 0x0005 for work order reassignment, and 0x0006 for work order closure. The operation subject identifier is the first 20 bytes of the SHA-256 hash of the executor's digital identity public key, used to uniquely identify the entity performing the operation. The operation trigger timestamp is the network time at which the operation was executed on the consensus node, with microsecond precision. The pre-operation state data snapshot is a serialized representation of the complete key-value pair set of work order data in the local state database of the consensus node before the operation, stored as a variable-length byte array. The post-operation state data snapshot is a serialized representation of the complete key-value pair set of work order data in the local state database of the consensus node after the operation, stored as a variable-length byte array.

[0049] Each consensus node returns the retrieved underlying raw operation logs one by one. From all the returned operation logs, they are arranged in ascending order of the flow node position, and duplicate log entries are removed. The removal rule is: when multiple consensus nodes return log entries with the same flow node position, the one with the earliest operation trigger timestamp field is used, and the rest are discarded.

[0050] Step 72: Based on the underlying original operation log and the discrete coordinate point set, combine the content of the underlying original operation log and the coordinate data of the discrete coordinate point set into a unified data structure. Add the current timestamp and a unique work order identifier to the data structure to obtain the data package to be uploaded to the blockchain for evidence storage. Specifically, this includes: combining the retrieved content of the underlying original operation log with the generated discrete coordinate point set... The coordinate data is combined to construct a unified data structure. This data structure is encoded in JSON format. The JSON data structure is then compactly serialized, and whitespace and newline characters are removed to obtain a continuous byte sequence. The gzip compression algorithm is applied to this byte sequence at the default compression level 6 to obtain a compressed byte stream. The compressed byte stream is used as the data packet to be uploaded to the blockchain for evidence storage, denoted as Payload.

[0051] In this embodiment of the invention, by selectively extracting the underlying original operation logs covered by the suspected mutation segment, the physical operation site evidence, including the operation subject, time, and status snapshot, is fully preserved, ensuring the integrity and loss prevention of anomaly tracing information. At the same time, the underlying business operation records are structurally combined with the geometric coordinate features of the two-dimensional phase plane, and timestamps and unique identifiers are added to construct a multi-dimensional evidence chain that mutually corroborates physical operation evidence and mathematical analysis features. This improves the information density and standardization of the data package to be uploaded to the blockchain for evidence storage, ensuring the unforgeability and global uniqueness of the evidence storage certificate from the underlying data structure.

[0052] In a preferred embodiment of the present invention, step 8 above may include: Step 81: Based on the data packet to be uploaded to the blockchain for evidence storage, broadcast the data packet to all consensus nodes in the network through the peer-to-peer communication network of the distributed ledger. Each consensus node verifies the validity of the data packet according to the preset Byzantine fault-tolerant consensus rule. After passing the validity verification, the data packet is packaged to generate a new block and appended to the last block of the existing blockchain. Specifically, this includes: broadcasting the data packet to be uploaded to the blockchain to all consensus nodes through the peer-to-peer communication network of the distributed ledger. The broadcast adopts a structured overlay network based on a distributed hash table: local consensus nodes select the 20 neighbor nodes with the closest XOR distance from the routing table based on the SHA-256 hash value of the data packet as the target distance and forward it in parallel. The forwarding message contains a complete copy of the data packet. The receiving node continues to forward the message to the 20 closest nodes in its routing table, while checking the globally unique identifier of the message to avoid loop retransmission, until all online nodes in the network have received it. After receiving the message, each consensus node performs four verifications according to the practical Byzantine fault-tolerant consensus rules: First, it uses a probabilistic set query structure to determine whether the work order unique identifier in the evidence storage data packet is a confirmed work order; Second, it independently recalculates the total cumulative offset within the segment from local storage according to the methods in steps 51 to 52, and compares it with the recorded value in the evidence storage data packet, requiring the deviation rate to be no more than one-thousandth; Third, it independently recalculates the discrete coordinate point set from local circulating data according to the methods in steps 11 to 22, and compares it point by point with the recorded value in the evidence storage data packet, requiring the absolute value of the coordinate difference to be no more than the smallest floating-point unit; Fourth, it decompresses the evidence storage data packet, requiring successful decompression and the length to be consistent with the packet header record.

[0053] After verification, each node broadcasts the verification result with a digital signature. Let the total number of nodes be N, and the Byzantine tolerance f be (N-1) / 3 rounded down. The master node starts packaging after collecting at least 2f+1 verified tickets: the new block height is the current end-of-chain block height plus 1; the SHA-256 of the evidence storage data packet is filled into the transaction root hash field; the original bytes of the evidence storage data packet are filled into the data field; the current global state Merkle root is filled into the state root hash field; the SHA-256 of all fields in the concatenated block header is calculated as the hash of this block; the previous block hash pointer points to the end-of-chain block header hash value; and the new block is appended to the end of the chain.

[0054] Step 82: Based on the new block, extract the block height and block header hash value of the new block, and embed these values ​​into the notarization record field of the data packet to be uploaded to the blockchain for notarization, thus obtaining a trusted notarization certificate with a block identifier. Specifically, this includes extracting the block height and block header hash value from the new block. The block height is an 8-byte unsigned integer, strictly increasing from the genesis block. The block header hash value is independently recalculated by each consensus node using the same field concatenation order, and compared byte-by-byte with the value inherent in the block header. Once more than 2f+1 nodes confirm consistency, the entire network recognizes it. The two extracted values ​​are then filled into the constructed data structure: the block height is written into the block height field, the block header hash value is written as a 64-bit hexadecimal string into the block hash field, and the aggregated signature of the consensus nodes for the new block is written into the signature field. The aggregated signature is generated by the master node collecting no less than 2f+1 signature fragments and then using an elliptic curve threshold signature aggregation algorithm. The completed data structure is the trusted notarization certificate. The embedded block height value and block header hash value establish a one-to-one binding between the certificate and the on-chain block: the height value determines the block's timeline position on the chain, and the hash value determines the complete content of the block. If any data in the certificate is tampered with, its recalculated hash will not match the original value on the chain, and the tampering can be detected at any time thereafter.

[0055] Step 83: Based on the trusted evidence certificate, send the trusted evidence certificate to the work order initiating terminal that initiated the ICT work order through a preset communication interface. The work order initiating terminal then persistently writes the trusted evidence certificate to the local storage medium, completing the complete trusted evidence storage loop for the ICT technical service work order on the distributed ledger. Specifically, this includes: using a long-connection communication interface based on a secure transport layer encryption protocol, and employing a remote procedure call framework, returning the trusted evidence certificate as a byte stream to the work order initiating terminal. The request parameters include a unique work order identifier. The response embeds the complete certificate in a compressed byte stream. The certificate byte stream is decompressed and deserialized to restore the work order identifier, abnormal flow segment record, coordinate point set, enclosing circle parameter, block height, block hash, and signature. Using the block height value in the certificate as an index, the local lightweight block header database is searched to compare whether the hash value of the block corresponding to that height is consistent with the certificate record. If they are inconsistent or there is no record locally, a query is initiated to any three consensus nodes. The hash values ​​from at least two consistent sources are used for quasi-re-verification. The verified certificate is written to the local archive directory in binary format. The filename is created by concatenating the first 16 characters of the work order identifier, underscores, the current time in a standardized format, and a dot cert. After writing, the system synchronization interface is called to flush the buffer to the physical medium. After the terminal completes the writing, it sends a confirmation receipt containing the work order identifier and the certificate hash value to the master node. Upon receiving the receipt, the consensus node updates the work order's notarization status to "completed" and releases the intermediate computation data cached in steps 11 to 52. The trusted notarization loop of the ICT work order on the distributed ledger is completed. The terminal can verify the integrity and authenticity of the notarized data with the consensus node at any time using the block height and hash value in the certificate.

[0056] In this embodiment of the invention, the efficient distribution and cross-verification of evidence storage data packets in a multi-node environment are achieved through the collaborative application of distributed ledger peer-to-peer network broadcasting and Byzantine fault-tolerant consensus mechanism, effectively resisting the risks of single point of failure and malicious node tampering. After consensus verification, the data packets are packaged and uploaded to the blockchain, and the permanent solidification and irreversible evidence storage are achieved by relying on the chain cryptographic structure of the blockchain. Furthermore, the new block height and block header hash value are extracted and embedded into the evidence storage record, constructing a unique cryptographic anchor point with strong correlation between on-chain and off-chain data, ensuring the global traceability and judicial-grade non-repudiation of the evidence storage results. Finally, the trusted evidence storage certificate is sent back to the work order initiating terminal and local persistence is completed, forming a complete business closed loop from anomaly quantification, consensus on-chain uploading to terminal verification, improving the automation level, data credibility, and cross-domain audit collaboration efficiency of the ICT technical service work order evidence storage process.

[0057] like Figure 2 As shown, embodiments of the present invention also provide a blockchain-based trusted evidence storage system for ICT technology service work orders, including: The timestamp extraction and calculation module is used to extract the timestamp sequence of continuous flow nodes of ICT work orders in the distributed ledger, calculate the period-by-period difference of the timestamps of adjacent nodes, and obtain the time interval change sequence. The phase plane mapping module is used to map the state hash transition of each flow node and the corresponding block height in the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points. The minimum bounding circle calculation module is used to explore the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum bounding circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum bounding circle. The flow path division module is used to divide the flow path into smooth flow segments based on the target coordinate point set, and to divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into abrupt change suspicious segments. The total offset calculation module is used to accumulate the difference of the state hash values ​​of adjacent nodes along the increasing direction of block height within a suspected mutation segment, so as to obtain the total cumulative offset within the segment that reflects the degree of tampering. The evidence storage anomaly determination module is used to compare the total cumulative offset within a segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly determination result. The evidence storage data encapsulation module is used to encapsulate the underlying original operation log and discrete coordinate point set corresponding to the mutation suspicious segment in response to the evidence storage anomaly judgment result, and obtain the evidence storage data packet to be uploaded to the chain. The on-chain broadcast and credential return module is used to broadcast the data packets to be stored on the blockchain using the underlying consensus mechanism of the distributed ledger, obtain trusted credentials with block identifiers, and return the trusted credentials to the work order initiating terminal, thus completing the complete trusted credential storage loop of ICT technical service work orders on the distributed ledger.

[0058] It should be noted that this system is a system corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0059] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A blockchain-based method for trusted storage of ICT service work orders, characterized in that: The method includes: Step 1: Extract the timestamp sequence of continuous flow nodes of ICT work orders in the distributed ledger, calculate the period-by-period difference of the timestamps of adjacent nodes, and obtain the time interval change sequence. Step 2: Map the state hash transition of each flow node and the corresponding block height within the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points; Step 3: Explore the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum enclosing circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum enclosing circle; Step 4: Divide the flow path into smooth flow segments based on the target coordinate point set, and divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into abrupt change suspicious segments. Step 5: Within the suspected mutation segment, accumulate the difference in the state hash values ​​of adjacent nodes along the increasing direction of block height to obtain the total cumulative offset within the segment that reflects the degree of tampering. Step 6: Compare the total cumulative offset within the segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly judgment result; Step 7: In response to the evidence storage anomaly determination result, encapsulate the underlying original operation log and discrete coordinate point set corresponding to the mutation suspicious segment to obtain the evidence storage data packet to be uploaded to the chain. Step 8: Utilize the underlying consensus mechanism of the distributed ledger to broadcast the data packet to be stored on the chain, obtain a trusted storage certificate with a block identifier, and return the trusted storage certificate to the work order initiating terminal to complete the complete trusted storage loop of the ICT technical service work order on the distributed ledger.

2. The blockchain-based ICT service work order trusted storage method according to claim 1, characterized in that, Step 1: Extract the timestamp sequence of continuous flow nodes of ICT work orders within the distributed ledger, calculate the period-by-period difference between adjacent node timestamps, and obtain the time interval change sequence, including: Based on the flow records of ICT work orders in each block of the distributed ledger, the block header timestamp field of the block where each flow node completed processing is extracted, and the timestamps of each flow node are arranged in ascending order of block height to obtain a continuous flow node timestamp sequence. Based on the continuous flow node timestamp sequence, the difference between the timestamp of the next node and the timestamp of the previous node is calculated in turn to obtain the flow time interval between every two adjacent flow nodes. The flow time intervals are arranged in the order of flow occurrence to obtain the flow time interval sequence between adjacent nodes. Based on the sequence of time intervals between adjacent nodes, the difference between the next time interval and the previous time interval is calculated sequentially to obtain the segmented change between each adjacent time interval. The segmented changes are then arranged in the order of occurrence to obtain the sequence of time interval changes.

3. The blockchain-based ICT technology service work order trusted storage method according to claim 2, characterized in that, Step 2: Map the state hash transition values ​​of each transition node and the corresponding block height within the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points, including: Based on the flow nodes corresponding to each element in the time interval change sequence, the Merkle root hash value of the block where each flow node is located is obtained from the distributed ledger. The Merkle root hash value of each flow node is XORed bit by bit with the Merkle root hash value of the previous flow node to obtain the state hash transition amount corresponding to each flow node. Based on the values ​​of each element in the time interval change sequence and the state hash transitions corresponding to each transition node, each transition node is mapped to a two-dimensional phase plane one by one, with the time interval change as the horizontal axis coordinate value and the state hash transition as the vertical axis coordinate value, to obtain a discrete coordinate point set.

4. The blockchain-based ICT technology service work order trusted storage method according to claim 3, characterized in that, Step 3: Probe the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum enclosing circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum enclosing circle, including: Based on the set of discrete coordinate points, three non-collinear discrete coordinate points are arbitrarily selected on the two-dimensional phase plane. An initial circumcircle is determined based on the three discrete coordinate points. The detection results are obtained by detecting whether there are discrete coordinate points on the two-dimensional phase plane located outside the initial circumcircle. Based on the detection results, when there are discrete coordinate points located outside the initial circumcircle, the initial circumcircle is taken as the current circumcircle, and the boundary of the current circumcircle is expanded outward to include the discrete coordinate points outside. The center position and radius of the circumcircle are re-determined based on the expanded set of covered points. The boundary expansion operation is repeated until there are no discrete coordinate points located outside the circumcircle on the two-dimensional phase plane, thus obtaining the smallest enclosing circle that covers all discrete coordinate points. Based on the minimum enclosing circle, extract all discrete coordinate points traversed by the circumference of the minimum enclosing circle to obtain the set of target coordinate points located on the boundary of the minimum enclosing circle.

5. The blockchain-based ICT service work order trusted storage method according to claim 4, characterized in that, Step 4: Divide the flow path into smooth flow segments based on the target coordinate point set, and divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into segments with suspected abrupt changes, including: Based on the set of target coordinate points, determine the position of the flow node corresponding to each target coordinate point on the flow path, and divide the continuous flow node interval between two adjacent target coordinate points on the flow path into a smooth flow segment; Based on the relative positional relationship between the discrete coordinate point set and the minimum enclosing circle, the free coordinate points located outside the boundary of the minimum enclosing circle are identified, the position of the flow node corresponding to each free coordinate point on the flow path is determined, and the continuous flow node interval containing free coordinate points on the flow path is divided into abrupt change suspicious segments.

6. The blockchain-based ICT service work order trusted storage method according to claim 5, characterized in that, Step 5: Within the suspected mutation segment, cumulatively add the differences in the state hash values ​​of adjacent nodes along the increasing block height direction to obtain the total cumulative offset within the segment, reflecting the degree of tampering, including: Based on the suspected mutation segment, starting from the initial flow node of the suspected mutation segment, the state hash value of the subsequent flow node is XORed with the state hash value of the previous flow node in the direction of increasing block height to obtain the state hash difference value of each pair of adjacent flow nodes. Based on the state hash difference values ​​of each adjacent transfer node within the suspected mutation segment, all state hash difference values ​​are summed to obtain the total cumulative offset within the segment, which reflects the degree of state data tampering within the suspected mutation segment.

7. The blockchain-based ICT service work order trusted storage method according to claim 6, characterized in that, Step 6: Compare the total cumulative offset within the segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly determination result, including: Based on the total cumulative offset within the segment, the value of the total cumulative offset within the segment is compared with the pre-set evidence storage security envelope tolerance to obtain the comparison result. Based on the size comparison results, when the total cumulative offset within a segment is less than or equal to the evidence preservation safety envelope tolerance, it is determined that the segment with the suspected mutation does not have evidence preservation anomalies; when the total cumulative offset within a segment is greater than the evidence preservation safety envelope tolerance, it is determined that the segment with the suspected mutation has evidence preservation anomalies, and the evidence preservation anomaly determination result is obtained.

8. The blockchain-based ICT technology service work order trusted storage method according to claim 7, characterized in that, Step 7: In response to the evidence storage anomaly determination result, encapsulate the underlying original operation log and discrete coordinate point set corresponding to the suspected mutation segment to obtain the evidence storage data packet to be uploaded to the chain, including: Based on the results of the evidence storage anomaly determination, the underlying original operation logs corresponding to the transfer nodes covered by the mutation suspicious segments are retrieved from the local storage of each consensus node of the distributed ledger. The underlying original operation logs include the operation type identifier, operation subject identifier, operation trigger timestamp, and state data snapshots before and after the operation of the transfer node. Based on the underlying original operation log and the discrete coordinate point set, the content of the underlying original operation log and the coordinate data of the discrete coordinate point set are combined into a unified data structure. The current timestamp and the unique identifier of the work order are added to the data structure to obtain the data package to be uploaded to the blockchain for evidence storage.

9. The blockchain-based ICT service work order trusted storage method according to claim 8, characterized in that, Step 8: Utilize the underlying consensus mechanism of the distributed ledger to broadcast the data packet to be uploaded to the blockchain for evidence storage, obtaining a trusted evidence storage certificate with a block identifier. Return the trusted evidence storage certificate to the work order initiating terminal, completing the full trusted evidence storage loop for ICT technical service work orders on the distributed ledger, including: Based on the data packet to be uploaded to the blockchain for evidence storage, the data packet is broadcast to all consensus nodes in the network through the peer-to-peer communication network of the distributed ledger. Each consensus node verifies the validity of the data packet according to the preset Byzantine fault-tolerant consensus rules. After the validity verification is passed, the data packet is packaged to generate a new block and appended to the last block of the existing blockchain. Based on the new block, extract the block height value and block header hash value of the new block, and embed the block height value and block header hash value into the evidence record field of the data packet to be uploaded to the blockchain for evidence storage, so as to obtain a trusted evidence storage certificate with block identifier; Based on the trusted evidence, the trusted evidence is sent to the work order initiating terminal that initiates the ICT work order through a preset communication interface. The work order initiating terminal then persistently writes the trusted evidence into the local storage medium, completing the complete trusted evidence storage loop for the ICT technical service work order on the distributed ledger.

10. A blockchain-based trusted evidence storage system for ICT technology service work orders, wherein the system implements the method as described in any one of claims 1 to 9, characterized in that, include: The timestamp extraction and calculation module is used to extract the timestamp sequence of continuous flow nodes of ICT work orders in the distributed ledger, calculate the period-by-period difference of the timestamps of adjacent nodes, and obtain the time interval change sequence. The phase plane mapping module is used to map the state hash transition of each flow node and the corresponding block height in the time interval change sequence to a two-dimensional phase plane to obtain a set of discrete coordinate points. The minimum bounding circle calculation module is used to explore the boundary contraction range point by point along the two-dimensional phase plane, calculate the minimum bounding circle covering all discrete coordinate points, and extract the set of target coordinate points located on the boundary of the minimum bounding circle. The flow path division module is used to divide the flow path into smooth flow segments based on the target coordinate point set, and to divide the flow path corresponding to the free coordinate points located outside the minimum enclosing circle into abrupt change suspicious segments. The total offset calculation module is used to accumulate the difference of the state hash values ​​of adjacent nodes along the increasing direction of block height within a suspected mutation segment, so as to obtain the total cumulative offset within the segment that reflects the degree of tampering. The evidence storage anomaly determination module is used to compare the total cumulative offset within a segment with the evidence storage security envelope tolerance to obtain the evidence storage anomaly determination result. The evidence storage data encapsulation module is used to encapsulate the underlying original operation log and discrete coordinate point set corresponding to the mutation suspicious segment in response to the evidence storage anomaly judgment result, and obtain the evidence storage data packet to be uploaded to the chain. The on-chain broadcast and credential return module is used to broadcast the data packets to be stored on the blockchain using the underlying consensus mechanism of the distributed ledger, obtain trusted credentials with block identifiers, and return the trusted credentials to the work order initiating terminal, thus completing the complete trusted credential storage loop of ICT technical service work orders on the distributed ledger.

Images