An industry-trustworthy data cross-chain management and control method, system and medium

Abstract

The application relates to an industrial trusted data cross-chain management and control method, system and medium, and relates to the technical field of industrial data cross-chain management and control; wherein the method comprises the following steps: assigning an industrial internet identification code to an industrial entity, generating a mapping voucher in combination with a block chain wallet address; sending and standardizing original industrial data according to a cross-chain sharing request, forming a cross-chain data packet in combination with the mapping voucher; verifying the cross-chain data packet, extracting industrial trusted data in combination with a smart contract according to a data access request; updating data management authority according to a permission control rule template according to a data use scene, and regulating and controlling industrial trusted data; extracting permission abnormal application behavior, and marking the data management authority of a data invoker as to be revoked in combination with a traceability audit rule. The method of the application realizes source trust and whole-process traceability of data sharing by means of a unique mapping mechanism of the industrial internet identification and the block chain address, and gives the industrial entity a unique cross-chain identity.

Description

Technical Field

[0001] This application relates to the field of cross-chain management technology for industrial data, and in particular to a method, system and medium for cross-chain management of trusted industrial data. Background Technology

[0002] With the in-depth development of the Industrial Internet, industrial data has become a core production factor, and cross-enterprise and cross-platform data sharing has become the key to improving the collaborative efficiency of the industrial chain.

[0003] Industrial data is scattered across private platforms of different enterprises or public platforms in the industry. When sharing across chains, there is a lack of unified identity anchoring and traceability mechanisms, making the data source unreliable, the transmission process easy to tamper with, and the data flow trajectory impossible to trace.

[0004] Traditional role-based access control (RBAC) can only achieve coarse-grained control over whether access is allowed, and cannot achieve precise field-level and scenario-based permission allocation based on data type, usage scenario, shared object, etc., resulting in over-authorization or under-authorization of data.

[0005] The inconsistent data formats and protocol standards across different platforms, coupled with the lack of standardized cross-chain data encapsulation and interaction mechanisms, make cross-enterprise and cross-industry data collaboration difficult, creating new data silos. Furthermore, the lack of a full-process recording and auditing mechanism for accessing, using, and modifying data after sharing makes it impossible to identify the responsible party or proactively revoke sharing permissions in the event of data leakage or misuse.

[0006] Existing patents disclose a blockchain construction method for distributed identity authentication in the industrial field. At the certification authority level, the identity verification mark of the industrial entity is recorded in the mark resolution system. The digital identity of the industrial entity is certified and endorsed by the certification authority (e.g., government, enterprise), and this certification and endorsement are completed before the industrial entity is uploaded to the blockchain. Based on the mark recorded by the industrial entity at the certification authority level, a blockchain address is assigned to each industrial entity in the industrial network. The industrial entity registers on the blockchain according to the specific address, preparing for the on-chain operation, thereby protecting its digital identity from the influence of other devices. After being uploaded to the blockchain, a blockchain-based digital identity authentication system performs trusted authentication of the industrial entity's digital identity information. The blockchain-based digital identity authentication system ensures the authenticity of the digital identity information and provides trusted authentication services.

[0007] The existing technical solutions mentioned above have the following drawbacks: they usually only focus on the encrypted storage of single-chain data and do not involve the identification and identity binding in cross-chain scenarios; or they only achieve coarse-grained permission control based on roles and lack fine-grained and precise control capabilities; and they usually do not establish a mechanism for integrating identifier resolution with blockchain, which cannot solve the problems of standardized interaction and trusted traceability of cross-chain data. Summary of the Invention

[0008] To address the shortcomings of existing technologies, the purpose of this application is to provide a method, system, and medium for cross-chain management of trusted industrial data. By using a unique mapping mechanism between industrial internet identifiers and blockchain addresses, industrial entities are given a unique cross-chain identity, enabling source trust and full-process traceability of data sharing. Through a four-level fine-grained permission management rule template, field-level and scenario-based permission allocation is achieved based on data identification attributes, replacing the traditional coarse-grained management based on roles.

[0009] This was achieved using the following technical solutions: Firstly, this application provides a method for cross-chain management and control of trusted industrial data, including: Industrial Internet identification codes are assigned to industrial entities, and combined with blockchain wallet addresses, mapping certificates are generated and stored on the blockchain. Based on the cross-chain sharing request and the standardized parsing of the original industrial data, combined with the mapping credentials, a cross-chain data packet is formed. Based on data access requests and smart contracts, cross-chain data packets are received and verified to extract trusted industrial data. Based on the preset permission control rule template and according to the data usage scenario, allocate and update data management permissions to regulate industrial trusted data; Internet identifier logs are used to monitor the cross-chain data sharing behavior of smart contracts, and combined with the blockchain ledger of identifier resolution nodes to form a data flow trajectory log; Analyze the data flow logs to extract abnormal application behaviors and, in conjunction with source tracing and auditing rules, mark the data control permissions of data callers as pending revocation.

[0010] By adopting the above technical solutions, based on blockchain smart contracts and cross-chain communication protocols, the system maps identifier codes and wallet addresses to the blockchain for evidence storage, standardizes and parses raw data to form cross-chain packages, dynamically manages data access using permission rule templates, and utilizes log analysis and ledger auditing to achieve tracking of data flow and automatic revocation of abnormal permissions. This significantly improves the trustworthiness and sharing of industrial data, cross-chain interoperability, fine-grained security, and end-to-end traceability.

[0011] Preferably, an industrial internet identifier code is assigned to the industrial entity, and combined with the blockchain wallet address, a mapping certificate is generated and stored on the blockchain, including: Register and analyze industrial entities, and extract their core attribute information; Based on the entity attribute information and in accordance with the Industrial Internet Identification Coding Rules, an Industrial Internet Identification Code is generated and stored in the Identification Resolution Node; The data provider undergoes real-name authentication and qualification verification. If both are compliant, a corresponding blockchain node is constructed and a blockchain wallet address is generated. The blockchain wallet address is associated with the identity information of the data provider, and after consensus is reached through smart contracts, the data is stored on the blockchain. Fields are added based on the identifier resolution node, and associated with the blockchain wallet address of the smart contract to build a mapping relationship table, generate mapping credentials, and store them on the blockchain. Entity attribute information is detected and compared according to the event monitoring cycle; If the entity attribute information changes, the industrial internet identifier code will be updated according to the identifier resolution node, a new mapping certificate will be generated, and the smart contract will be triggered to verify the data management authority. After the verification is successful, the new mapping certificate will be synchronized to the blockchain for storage.

[0012] By adopting the above technical solution, based on industrial internet identification coding and blockchain smart contract technology, a unique identification code is generated by registering entity attributes and associated with a wallet address to build a mapping certificate for on-chain storage. Event monitoring is used to detect attribute changes in real time, dynamically update the identification code, and synchronize the new certificate after triggering permission verification. This significantly improves the reliable storage, anti-tampering capability, and full lifecycle traceability of industrial entity data.

[0013] Preferably, based on the cross-chain sharing request and the standardized parsing of the original industrial data, combined with the mapping credentials, a cross-chain data packet is formed, including: The identifier resolution node performs permission verification on the blockchain wallet address and mapping credential corresponding to the cross-chain sharing request; If a valid mapping relationship exists for the current blockchain wallet address, and the mapping certificate has not expired or been revoked, then the cross-chain sharing request will be parsed to extract the original industrial data. The raw industrial data is parsed according to the encoding rules of the Industrial Internet Identifier Code, and data attribute elements containing data type, scenario, sharing scope and collection timestamp are extracted. The data attribute elements, raw industrial data, mapping credentials, and industrial internet identification codes are standardized and encapsulated to form an initial data package; Perform multidimensional verification on the initial data packet to calculate data integrity and data packet size; If the data integrity is greater than the preset integrity threshold and the data packet size is less than or equal to the preset transmission limit threshold, the initial data packet is encrypted to form a cross-chain data packet.

[0014] By adopting the above technical solution, based on the identifier resolution node and smart contract permission verification, and combined with the encoding rules to parse the original data attribute elements, cross-chain data packets are formed through integrity and capacity threshold encryption encapsulation, thereby improving the security, reliability and heterogeneous system compatibility of cross-chain sharing of industrial data.

[0015] Preferably, based on the data access request and in conjunction with the smart contract, cross-chain data packets are received and verified, and industrial trusted data is extracted, including: Parse the data access request to extract the recipient's digital signature and the target wallet address; If the recipient's digital signature verification is valid, the target wallet address will be checked and matched according to the data sharing permission table; If the current blockchain wallet address is successfully matched, the target Internet identifier is queried according to the mapping relationship table to obtain the off-chain storage location of the cross-chain data packet; A secure transmission channel is established by connecting the off-chain storage location with the recipient's location based on the smart contract; Cross-chain data packets are transmitted through a secure transmission channel, and a proof hash value is provided; Analyze cross-chain data packets, calculate the hash value of the data packets, and compare it with the evidence storage hash value; If the two are the same, it indicates that the current cross-chain data packet has not been tampered with and is temporarily stored in the security buffer. The cross-chain data packets are decrypted to extract the industrial internet identifier code, and then parsed in conjunction with the identifier resolution node to extract the original industrial data. By associating raw industrial data with their corresponding attribute tags, reliable industrial data can be formed.

[0016] By adopting the above technical solutions, based on the digital signature verification and address matching mechanism of smart contracts, combined with off-chain storage positioning and hash comparison anti-tampering technology, a secure transmission channel is established to decrypt and parse industrial data, realizing the reliable reception of cross-chain data packets and the reliable extraction of original industrial data, which significantly improves the security, integrity and interoperability of cross-chain sharing of industrial data.

[0017] Preferably, based on a preset access control rule template and according to data usage scenarios, data management permissions are allocated and updated to regulate trusted industrial data, including: Based on business objectives, data usage scenarios are classified and collected to form a data application framework; Based on the data application framework, permissions are assigned to data users to form a permission control rule template; Based on the permission configuration object, select several industrial internet identification codes and combine them with the permission control rule template to generate a permission policy object; The smart contract performs on-chain notarization and signature verification of the permission policy object, and returns the notarized hash value of the permission. The hash value of the permission storage is decomposed to obtain object-specific identifiers for different levels, and each item is verified according to the four-level permission layer. If any level of validation fails, the smart contract rejects the access request and logs the failure. If all passes, then based on the data field level permissions, the allowed access fields in the cross-chain data packet are filtered to generate a restricted dataset, which is then transmitted to the data receiver through a secure transmission channel, and the access log is recorded. If the data provider's business changes, the identifier resolution node verifies the data provider's identity, initiates a permission update request, and resubmits the new permission control rules to the smart contract, overriding the old permission control rules and storing them on the blockchain, thus completing the permission control of industrial trusted data. If the current access control rule is pending revocation, the data provider calls the smart contract's revocation access method to revoke the data caller's authorization in real time, thus completing the access control of industrial trusted data.

[0018] By adopting the above technical solution, permission rule templates are generated based on business scenario classification. After on-chain storage and four-level verification through smart contracts, field-level data filtering and dynamic permission updates / revocations are realized, improving the fine-grained security control, dynamic scalability and full auditability of industrial trusted data.

[0019] Preferably, the access control rule template includes: Based on the data management dimensions, the permission rules are layered to obtain a hierarchical permission control framework; Feature analysis is performed on the hierarchical permission control skeleton to extract the rule-based permission data structure; Based on the rule permission data structure and the permission rule mapping table, the permission rule set is associated to generate a scenario permission policy; Based on the scenario permission policy, the preset data application scenario template is structurally modified to generate permission rule objects; Based on the smart contract's registration permission mechanism, the permission rule object is stored on the blockchain, and the storage transaction hash is returned. By combining the notarized transaction hash with the permission verification function, the permission rule object is merged to generate a permission control rule template.

[0020] By adopting the above technical solutions, based on the hierarchical permission control skeleton and the mapping of scenario permission policies, and through the fusion of rule object on-chain evidence storage and hash verification, a traceable and structured permission control rule template is constructed, which improves the uniformity, security and execution consistency of industrial data permission management.

[0021] Secondly, this application also provides an industrial trusted data cross-chain management and control system, which adopts the following technical solution: An industrial trusted data cross-chain management and control system, used to implement a method for industrial trusted data cross-chain management and control, includes: The mapping establishment module is used to assign industrial internet identification codes to industrial entities, combine them with blockchain wallet addresses to generate mapping credentials and store them on the blockchain. The cross-chain encapsulation module is used to send and standardize the parsing of raw industrial data according to cross-chain sharing requests, and combine it with mapping credentials to form cross-chain data packets; The data interaction module is used to receive and verify cross-chain data packets and extract trusted industrial data based on data access requests and smart contracts. The access control module is used to allocate and update data management permissions according to preset access control rule templates and data usage scenarios, thereby regulating trusted industrial data. The behavior monitoring module is used to monitor the Internet identifier logs of smart contract data cross-chain sharing behavior, and combine them with the blockchain ledger of the identifier resolution node to form a data flow trajectory log. The source tracing and auditing module is used to analyze data flow logs, extract abnormal application behaviors, and, in conjunction with source tracing and auditing rules, mark the data control permissions of data callers as pending revocation.

[0022] By adopting the above technical solutions, based on blockchain smart contracts and identifier resolution technology, and through on-chain storage of mapping credentials, standardized encapsulation of cross-chain data packets, dynamic management of permission rule templates, and auditing of flow logs, trusted interaction, fine-grained security, and automatic revocation of abnormal permissions for cross-chain sharing of industrial data are achieved.

[0023] Thirdly, this application also provides a storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the industrial trusted data cross-chain management method as described above.

[0024] In summary, this application includes at least the following beneficial effects: (1) The four-level fine-grained permission control rule template of this application realizes field-level and scenario-based permission allocation based on data identification attributes, replacing the traditional coarse-grained control based on roles; (2) This application fills the technical gap in auditing cross-chain data sharing behavior by constructing a traceability and auditing system that links identifier resolution logs with blockchain ledgers; (3) This application uses the unique mapping mechanism between industrial internet identifiers and blockchain addresses to give industrial entities (equipment / products / data) a unique cross-chain identity, thereby realizing the source trust and full-process traceability of data sharing. Attached Figure Description

[0025] Figure 1This is a schematic diagram of the overall process of the cross-chain management method for trusted industrial data in this application; Figure 2 This is a flowchart illustrating step S4 in this application; Figure 3 This is a flowchart illustrating the access control rules template in this application; Figure 4 This is a schematic diagram of the structure of the industrial trusted data cross-chain management system in this application. Detailed Implementation

[0026] The present application will be further described in detail below with reference to the accompanying drawings.

[0027] Reference Figure 1 This application discloses a method for cross-chain management of trusted industrial data, comprising: S1: Assign an industrial internet identification code to an industrial entity, combine it with a blockchain wallet address to generate a mapping certificate and store it on the blockchain; S2: Based on the cross-chain sharing request, send and standardize the original industrial data, and combine it with the mapping certificate to form a cross-chain data packet; S3: Based on data access requests and smart contracts, receive and verify cross-chain data packets and extract trusted industrial data. S4: Based on the preset permission control rule template and according to the data usage scenario, allocate and update data management permissions to regulate industrial trusted data; S5: Internet identifier logs that monitor the cross-chain data sharing behavior of smart contracts, and combine them with the blockchain ledger of identifier resolution nodes to form a data flow trajectory log; S6: Analyze the data flow log, extract abnormal application behavior, and, in conjunction with the source tracing audit rules, mark the data control permissions of the data caller as pending revocation.

[0028] In this embodiment, in the quality traceability of the global automotive parts supply chain, upstream suppliers assign a unique Industrial Internet identifier (such as a Handle code) to the motor stators they produce and bind it to their own blockchain wallet address to generate a mapping certificate containing the identifier, address, and hash value, which is then uploaded to the consortium blockchain for storage. When the midstream assembly plant initiates a cross-chain sharing request, it standardizes, parses, and encrypts the original quality inspection data (such as insulation resistance and withstand voltage value) through a cross-chain gateway, combines it with the mapping certificate to form a cross-chain data packet, and sends it to the smart contract of the target chain.

[0029] The smart contract of the final assembly plant verifies the signature and timestamp of the cross-chain data packet based on the preset data access request (only viewing the insulation resistance pass rate statistics, without obtaining the original value), and extracts the de-identified industrial trusted data for production scheduling; according to the preset permission control rule template (granting only query rights to quality auditors and temporary download rights to process engineers), management permissions are dynamically allocated and updated regularly based on the current data usage scenario (such as new product import evaluation), strictly controlling access to sensitive parameters; at the same time, the monitoring node records the Internet identification log of each cross-chain call (such as identification code, caller address, timestamp, operation type), and performs hash verification with the Hyperledger Fabric ledger of the identification resolution node to form an immutable data flow trajectory log.

[0030] The audit service periodically analyzes the logs. When it discovers that a Tier 2 supplier frequently queries the lifespan data of competitors' components during unauthorized periods, it extracts this abnormal permission behavior and automatically marks the data control permission of the data caller as pending revocation based on the source tracing audit rules (such as multiple accounts from the same IP address, high-frequency requests during non-working hours). This triggers a multi-signature review process, thereby achieving fine-grained permission control and full-process auditability for cross-chain data sharing.

[0031] In one specific implementation, step S1 includes: Register and analyze industrial entities, and extract their core attribute information; Based on the entity attribute information and in accordance with the Industrial Internet Identification Coding Rules, an Industrial Internet Identification Code is generated and stored in the Identification Resolution Node; The data provider undergoes real-name authentication and qualification verification. If both are compliant, a corresponding blockchain node is constructed and a blockchain wallet address is generated. The blockchain wallet address is associated with the identity information of the data provider, and after consensus is reached through smart contracts, the data is stored on the blockchain. Fields are added based on the identifier resolution node, and associated with the blockchain wallet address of the smart contract to build a mapping relationship table, generate mapping credentials, and store them on the blockchain. Entity attribute information is detected and compared according to the event monitoring cycle; If the entity attribute information changes, the industrial internet identifier code will be updated according to the identifier resolution node, a new mapping certificate will be generated, and the smart contract will be triggered to verify the data management authority. After the verification is successful, the new mapping certificate will be synchronized to the blockchain for storage.

[0032] In this embodiment, a unique Industrial Internet identifier is first assigned to each industrial entity (including equipment, products, and industrial data). This identifier contains core attribute information such as entity type, affiliated enterprise, and data dimension. Establish blockchain nodes on the Spark Chain Network and assign unique blockchain wallet addresses to participating enterprises and platforms. The wallet addresses are then linked to and authenticated with the enterprise's identity and the platform's qualifications. Establish a unique mapping relationship between industrial internet identification codes and blockchain wallet addresses. Through identification resolution nodes, the identification codes and wallet addresses are associated and stored, and mapping certificates are generated and stored on the blockchain to ensure the unique cross-chain identity of each industrial entity and provide a trusted identity foundation for cross-chain data sharing. When industrial entity information changes (such as a change in company name or expansion of data dimensions), the identifier code attribute is updated through the identifier resolution node, and the blockchain smart contract is triggered to automatically synchronize the mapping relationship, ensuring the real-time effectiveness of the mapping.

[0033] In one specific implementation, step S2 includes: The identifier resolution node performs permission verification on the blockchain wallet address and mapping credential corresponding to the cross-chain sharing request; If a valid mapping relationship exists for the current blockchain wallet address, and the mapping certificate has not expired or been revoked, then the cross-chain sharing request will be parsed to extract the original industrial data. The raw industrial data is parsed according to the encoding rules of the Industrial Internet Identifier Code, and data attribute elements containing data type, scenario, sharing scope and collection timestamp are extracted. The data attribute elements, raw industrial data, mapping credentials, and industrial internet identification codes are standardized and encapsulated to form an initial data package; Perform multidimensional verification on the initial data packet to calculate data integrity and data packet size; If the data integrity is greater than the preset integrity threshold and the data packet size is less than or equal to the preset transmission limit threshold, the initial data packet is encrypted to form a cross-chain data packet.

[0034] In this embodiment, the data provider (enterprise or platform) initiates a cross-chain data sharing request to the identifier resolution node through a client or API interface. The request includes at least: Raw industrial data (such as production data, quality inspection results, supply chain logistics information, etc., in formats such as JSON, CSV, binary, etc.), the industrial internet identifier of the data, the blockchain wallet address of the data provider, and the wallet address or scenario identifier of the target sharing party. Upon receiving a request, the identifier resolution node first verifies the data provider's permissions based on the data provider's wallet address and mapping credentials: it queries the local cache or calls the SparkChain smart contract to verify whether the wallet address has a valid mapping relationship with the data's industrial internet identifier. It then confirms that the mapping credentials have not expired or been revoked.

[0035] Based on the encoding rules of the Industrial Internet Identifier (such as the industry type and data dimension encoding in the prefix), the raw industrial data is automatically parsed to extract the following core attributes: Data types: such as production cycle time, temperature sampling value, and product defect rate.

[0036] Context: For example, production line 1 in workshop A, quality inspection station, and supply chain warehousing.

[0037] Scope of sharing: Determine the granularity of allowed sharing based on the company's preset policies or request parameters (e.g., only aggregated data, raw data can be made public, encryption is required, etc.).

[0038] Timestamp: The time when the data was generated or collected.

[0039] The parsed results are stored in a structured form (such as a JSON object) and associated with the original data.

[0040] The identifier resolution node retrieves the mapping certificate between the Industrial Internet identifier code and the data provider's wallet address from its local database or the SparkChain network. The certificate includes: identifier code, wallet address, mapping establishment time, attribute snapshot, signature, etc. The node verifies the signature and on-chain notarization hash of the certificate to ensure it has not been tampered with.

[0041] According to the preset integrated encapsulation protocol for identifiers, data, and credentials (e.g., based on CBOR or Protobuf), the following elements are combined into a cross-chain data packet in binary or JSON format: Industrial Internet identifier (plaintext), raw industrial data (which can be protected with symmetric encryption; this step only encapsulates the data, and encryption will be done in a later step), extracted core attributes (JSON object), mapping credentials (containing signature and on-chain evidence hash), data provider wallet address, encapsulation timestamp, and optional target address.

[0042] The generated cross-chain data packet is hashed (e.g., SHA-256), and the consistency of each part of the data packet is verified (e.g., verifying that the identifier code matches the one in the credential). The data packet size is also checked to ensure it does not exceed the limits of the blockchain or transport protocol (e.g., a maximum of 1MB). The verified cross-chain data packet is stored as a temporary object in the secure buffer of the identifier resolution node, and a unique ID of the data packet is returned to the data provider.

[0043] In one specific implementation, step S3 includes: Parse the data access request to extract the recipient's digital signature and the target wallet address; If the recipient's digital signature verification is valid, the target wallet address will be checked and matched according to the data sharing permission table; If the current blockchain wallet address is successfully matched, the target Internet identifier is queried according to the mapping relationship table to obtain the off-chain storage location of the cross-chain data packet; A secure transmission channel is established by connecting the off-chain storage location with the recipient's location based on the smart contract; Cross-chain data packets are transmitted through a secure transmission channel, and a proof hash value is provided; Analyze cross-chain data packets, calculate the hash value of the data packets, and compare it with the evidence storage hash value; If the two are the same, it indicates that the current cross-chain data packet has not been tampered with and is temporarily stored in the security buffer. The cross-chain data packets are decrypted to extract the industrial internet identifier code, and then parsed in conjunction with the identifier resolution node to extract the original industrial data. By associating raw industrial data with their corresponding attribute tags, reliable industrial data can be formed.

[0044] In this embodiment, the data recipient (enterprise or platform) uses its authenticated and bound blockchain wallet address to send a data access request to the smart contract on the SparkChain network via a client or API. The request includes: the industrial internet identifier of the target data, the recipient's wallet address, the request timestamp, and a description of the use case. The recipient uses its private key to digitally sign the request content to ensure the non-repudiation of the request. Upon receiving a request, the smart contract first verifies the validity of the signature, confirming that the request was indeed signed by the private key corresponding to the wallet address. Then, the contract queries the data sharing permission table (pre-configured by the data provider, recording which wallet addresses can access which identifier codes' data). It checks whether the recipient's wallet address is in the authorized list or meets the role- and attribute-based access control conditions (such as partners on the same blockchain). If verification fails, the contract returns a rejection response and logs the failure; if successful, it searches for the corresponding cross-chain data packet storage information in the on-chain mapping relationship based on the identifier code in the request. This information includes: the hash value of the encrypted data packet, the location of the data packet in off-chain storage (such as IPFS hash, distributed file system URL, identifier resolution node cache address), and the complete encrypted cross-chain data packet that the contract retrieves from the off-chain storage system. If the data packet is too large, only a pointer can be obtained, and the recipient can download it in blocks subsequently.

[0045] The smart contract sends encrypted cross-chain data packets to the receiving platform via a secure channel (such as TLS-encrypted HTTP or peer-to-peer direct connection). During transmission, the data packets remain AES-256 encrypted, concealing the plaintext. Simultaneously, the contract provides the on-chain hash value of the data packets for the receiving party to use for subsequent integrity verification. After transmission, the contract records the access log (receiving party address, identifier, and timestamp) on the blockchain.

[0046] Upon receiving the encrypted data packet, the receiving platform immediately calculates its hash value and compares it with the on-chain notarized hash provided by the smart contract. If they match, it indicates that the data packet has not been tampered with during transmission; if they do not match, the platform rejects the packet and reports an anomaly. After successful comparison, the platform temporarily stores the encrypted data packet in a secure buffer.

[0047] The receiving platform extracts the plaintext Industrial Internet Identifier (the unencrypted portion of the packet header) from the encrypted data packet. It then calls the identifier resolution node's parsing interface, inputting the identifier. The identifier resolution node returns complete attribute information for the identifier, including: entity type, affiliated company, data dimension definition, on-chain notarization hash of the mapping credential, and the data provider's wallet address.

[0048] The original data (in encrypted state) in the data packet is compared again with the hash verified in step five (to ensure that it has not been replaced during the parsing process).

[0049] Check whether the wallet address of the data provider returned by the parsing node is consistent with the wallet address in the mapping certificate carried in the data packet; at the same time, verify whether the signature of the mapping certificate is correct, and whether the on-chain evidence hash of the certificate is consistent with the hash (or independent evidence hash) in step five.

[0050] The smart contract is invoked to check whether the current recipient still has access rights (to prevent permissions from being revoked during transmission); after all verifications pass, the data packet is marked as trustworthy.

[0051] The receiving platform uses its blockchain wallet private key (or a symmetric key negotiated with the data provider; typically, the AES-256 key is transmitted separately by the data provider to the authorized recipient via a secure channel) to decrypt the encrypted data packet. The decrypted packet contains the original industrial data, core attributes, and mapping credentials. The platform extracts the original industrial data and corresponding attribute tags from this data, forming trusted industrial data that can be used in its internal business systems. Simultaneously, the platform logs this receiving operation (time, data identifier, decryption status).

[0052] Reference Figure 2 In one specific implementation, step S4 includes: Based on business objectives, data usage scenarios are classified and collected to form a data application framework; Based on the data application framework, permissions are assigned to data users to form a permission control rule template; Based on the permission configuration object, select several industrial internet identification codes and combine them with the permission control rule template to generate a permission policy object; The smart contract performs on-chain notarization and signature verification of the permission policy object, and returns the notarized hash value of the permission. The hash value of the permission storage is decomposed to obtain object-specific identifiers for different levels, and each item is verified according to the four-level permission layer. If any level of validation fails, the smart contract rejects the access request and logs the failure. If all passes, then based on the data field level permissions, the allowed access fields in the cross-chain data packet are filtered to generate a restricted dataset, which is then transmitted to the data receiver through a secure transmission channel, and the access log is recorded. If the data provider's business changes, the identifier resolution node verifies the data provider's identity, initiates a permission update request, and resubmits the new permission control rules to the smart contract, overriding the old permission control rules and storing them on the blockchain, thus completing the permission control of industrial trusted data. If the current access control rule is pending revocation, the data provider calls the smart contract's revocation access method to revoke the data caller's authorization in real time, thus completing the access control of industrial trusted data.

[0053] In this embodiment, a four-level permission control model is constructed based on the identifier attributes of industrial data: platform, user, role, and data field. Platform level: Limit the target platform scope for data sharing (e.g., only allow sharing to Inspur Industrial Internet Platform and Little Swan Smart Home Appliance Platform). User level: Restrict access to specific authorized users (e.g., only allow access to the other party's technical and management personnel); Role-based: Restricting user access roles (such as data query role, data usage role, and data secondary processing role); Data field level: restrict the data fields that can be accessed (e.g., only allow access to production pass rate data, and do not allow access to core process parameter fields). Data providers can preset permission rules based on data usage scenarios (such as supply chain collaboration, quality traceability, and R&D cooperation) through the permission configuration interface. The rules are then linked to the industrial internet identification code and stored on the blockchain. When a data recipient initiates an access request, the blockchain smart contract automatically calls the permission rule base to perform multi-level verification of the access recipient's platform qualifications, user identity, and role permissions, and only allows access requests that meet the rules to obtain data in the corresponding fields; After receiving a request, the smart contract first queries the on-chain permission library for the corresponding permission rule based on the identifier code. Then, it verifies each rule according to the four-level model: Platform level: Verify whether the platform identifier in the request is in the target platform list specified by the rule.

[0054] User level: Verify whether the user identity in the request is on the authorized user list.

[0055] Role-level: Verify whether the role intent of the request matches the role granted in the rules (e.g., querying a role that allows reading but not downloading raw data).

[0056] Data field level: If the request involves access to specific fields, only fields that are whitelisted in the rules will be returned.

[0057] If any level of verification fails, the contract directly rejects the request and logs the failure. If all verifications pass, the contract selects allowed fields from the encrypted cross-chain data packet based on data field-level permissions, generating a restricted dataset. This dataset is separate from the original data packet and contains only the authorized fields and their corresponding identifiers and credentials. The smart contract transmits the restricted dataset to the recipient through a secure channel, while simultaneously recording the access log (time, requester, accessed fields) on the blockchain.

[0058] Data providers can initiate permission update requests through the identifier resolution node due to business changes (such as termination of cooperation or adjustment of scenarios). The request includes: the target identifier code and the permission rules to be modified (such as removing a user, adding fields, or changing roles). After verifying the provider's identity, the identifier resolution node resubmits the updated permission rules to the smart contract. The smart contract overrides the old rules (or generates a new version) and stores it on the blockchain. The update takes effect immediately, and subsequent access requests will be verified according to the new rules. For permissions requiring immediate revocation, the provider can call the contract's revocation access method to revoke the authorization of a specific user in real time. Each time permission rules are updated or revoked, the smart contract triggers an event, notifying subscribed identifier resolution nodes and relevant platforms. The system records and archives the complete permission change history (operator, time, and changes) for subsequent auditing. Data recipients can query the latest permission status via the contract before their next access.

[0059] It supports dynamic adjustment and proactive revocation of permissions. Data providers update permission rules through identifier resolution nodes, and smart contracts synchronize and take effect in real time, ensuring the flexibility and security of permission management.

[0060] Reference Figure 3 In a specific implementation, the access control rule template includes: A: The permission rules are layered according to the data management dimensions to obtain a hierarchical permission control framework; B: Perform feature analysis on the hierarchical permission control skeleton to extract the rule permission data structure; C: Based on the rule permission data structure and the permission rule mapping table, associate the permission rule set to generate the scenario permission policy; D: Based on the scenario permission policy, the preset data application scenario template is structurally modified to generate permission rule objects; E: Based on the smart contract's registration permission mechanism, the permission rule object is stored on the blockchain and the storage transaction hash is returned; F: Based on the evidence storage transaction hash and the permission verification function, the permission rule object is merged to generate a permission control rule template.

[0061] In this embodiment, the architecture of the four-level permission control model is first defined, from highest to lowest: platform level, user level, role level, and data field level. Each level defines its control scope and granularity, i.e., the hierarchical permission control skeleton: Platform level: Limits the scope of target industrial internet platforms from which data can be shared (e.g., only allowing specific platforms such as Inspur and Little Swan).

[0062] User level: Restricts access to specific authorized users (such as technical personnel and managers of the other party's company).

[0063] Role-based: Assign each user a functional role in data usage (such as read-only query, data usage, secondary processing).

[0064] Data field level: Limit the specific data fields that users can access (e.g., only open the pass rate and output, and hide the core process parameters).

[0065] The data structure used to store permission rules includes the following core fields: associated industrial internet identifier (identifying controlled data), platform whitelist (list), authorized user list (user ID or decentralized identity DID), role type (enumerated value), accessible field whitelist (array of field names), applicable scenario tags (such as supply chain collaboration, quality traceability), validity period, creation time, signature, and other metadata.

[0066] In the identifier resolution node, a permission rule mapping table is added to associate each industrial internet identifier with its corresponding permission rule set. Rules can be divided into multiple records according to scenarios, supporting different permission policies for the same identifier in different scenarios. The mapping relationship is maintained through the identifier resolution node's API, and the rule hashes are ultimately stored on the blockchain for evidence.

[0067] A visual permission configuration interface has been developed for data providers. The interface provides predefined scenario templates (such as supply chain collaboration, quality traceability, and R&D cooperation), each template including recommended four-level permission configuration items (for example, in a supply chain collaboration scenario, only order-related fields are typically enabled). Data providers can select a template and fine-tune it, or customize it from scratch. After configuration, the system generates a structured permission rule object.

[0068] After the data provider confirms the permission rules, the system calls the registration permission method of the SparkChain smart contract to submit the rule object (including identifier code, permission details, timestamp, and provider signature) to the blockchain. After verifying the signature, the contract stores the rules in the on-chain permission library and returns the notarized transaction hash. Simultaneously, the identifier resolution node subscribes to on-chain permission change events and caches the latest rules locally for rapid subsequent verification.

[0069] Write a permission verification function in the SparkChain smart contract. This function receives access request parameters from the data recipient (platform identifier, user identity, request role, and list of request fields) and a target identifier code. Internally, the function queries the on-chain permission rules based on the identifier code and then compares them level by level. If the platform identifier is not in the whitelist, the request will be rejected. If the user's identity is not in the authorized user list, the request will be rejected. If the requested role exceeds the permissions granted to the role in the rule, then the request is denied. If the requested field is outside the field whitelist, only fields within the whitelist will be returned, or the request will be rejected.

[0070] The permission configuration interface provides modification and revocation functions. Data providers can select configured permission rules, adjust permission content at any level, or delete rules directly. The system generates a new rule version and uploads the new rule to the blockchain via the smart contract's permission update method, while the old rule is retained as history. For emergency revocation, the provider calls the revocation access interface to mark the permissions of the specified user or platform as invalid in real time.

[0071] After each permission verification, the smart contract records the verification result (time, requester, identifier code, pass level, and rejection reason) in an on-chain log, regardless of success or failure. Data providers can view all access attempts through a query interface for security auditing and compliance analysis.

[0072] In one specific implementation, steps S5 and S6 include: The blockchain smart contract records the entire process of cross-chain data sharing, including key information such as data upload time, sharing objects, access time, data usage behavior (query / download / secondary sharing), and permission change records. The log is associated with the industrial internet identification code. The identifier resolution node synchronously records the entire process log of data parsing, encapsulation, and transmission, forming a dual traceability system of identifier log and blockchain ledger; A traceability audit platform has been established, which supports enterprises to query the data flow trajectory through industrial internet identification codes or blockchain wallet addresses. The audit platform automatically links dual logs and generates a visualized traceability report. When data misuse or unauthorized access is discovered, the data provider can initiate a permission revocation request through the traceability and auditing platform. The smart contract will immediately freeze access to the relevant data and record the revocation, thus achieving controllability, traceability, and accountability for data sharing.

[0073] Reference Figure 4 An industrial trusted data cross-chain management system, applied to industrial trusted data cross-chain management methods, includes: The mapping establishment module is used to assign industrial internet identification codes to industrial entities, combine them with blockchain wallet addresses to generate mapping credentials and store them on the blockchain. The cross-chain encapsulation module is used to send and standardize the parsing of raw industrial data according to cross-chain sharing requests, and combine it with mapping credentials to form cross-chain data packets; The data interaction module is used to receive and verify cross-chain data packets and extract trusted industrial data based on data access requests and smart contracts. The access control module is used to allocate and update data management permissions according to preset access control rule templates and data usage scenarios, thereby regulating trusted industrial data. The behavior monitoring module is used to monitor the Internet identifier logs of smart contract data cross-chain sharing behavior, and combine them with the blockchain ledger of the identifier resolution node to form a data flow trajectory log. The source tracing and auditing module is used to analyze data flow logs, extract abnormal application behaviors, and, in conjunction with source tracing and auditing rules, mark the data control permissions of data callers as pending revocation.

[0074] In this embodiment, in a cross-regional factory collaborative manufacturing scenario, the group assigns an Industrial Internet Identifier (such as VAA code) to each CNC machine tool and binds it to the blockchain wallet address of the factory node, generating a mapping certificate containing the identifier, address, and data hash for on-chain storage. When the process optimization algorithm of factory A needs to call the historical processing parameters of similar machine tools in factory B, it first sends a cross-chain sharing request. The original vibration, current, feed rate, and other time-series data are standardized and parsed through the cross-chain gateway, and then encapsulated together with the mapping certificate to form a cross-chain data packet. The smart contract deployed in factory B verifies the data packet signature and timestamp according to the data access request (only used for training the process recommendation model and not exporting the original sequence), and then extracts homomorphically encrypted industrial trusted data (such as feature statistics) for the algorithm to use.

[0075] The access control module dynamically allocates temporary tokens based on the preset access template (granting read-only access during the training period to process analysts and real-time monitoring access to equipment maintenance personnel) according to the current process optimization scenario, and automatically updates the control strategy every 24 hours. Simultaneously, the behavior monitoring module records all cross-chain call identifiers, caller addresses, operation types, etc., as internet identifier logs, and cross-verifies them with irreversible transaction hashes in the Hyperledger Fabric ledger to form a data flow trajectory. The source tracing and auditing module analyzes the trajectory logs daily. When it detects that a temporary access token is still being attempted to be used after its expiration, or that an analyst account is fetching sensitive parameters in batches during unauthorized periods, it extracts such abnormal access behaviors. Based on auditing rules such as "cross-chain requests from the same identity exceeding 5 times / minute," it automatically marks the data caller's access control as pending revocation and triggers multi-node consensus auditing. This achieves refined access control and full lifecycle auditing for cross-factory data collaboration while ensuring data security.

[0076] A storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the industrial trusted data cross-chain management method as described above.

[0077] The embodiments described in this specific implementation are preferred embodiments of this application and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for cross-chain management and control of trusted industrial data, characterized in that, include: Industrial Internet identification codes are assigned to industrial entities, and combined with blockchain wallet addresses, mapping certificates are generated and stored on the blockchain. Based on the cross-chain sharing request and the standardized parsing of the original industrial data, a cross-chain data packet is formed in conjunction with the mapping certificate; Based on the data access request and smart contract, the cross-chain data packet is received and verified, and industrial trusted data is extracted. Based on the preset permission control rule template and according to the data usage scenario, data management permissions are allocated and updated to regulate trusted industrial data.

2. The industrial trusted data cross-chain management method according to claim 1, characterized in that, The process of assigning industrial internet identification codes to industrial entities, combining them with blockchain wallet addresses, generating mapping credentials, and storing them on the blockchain includes: Register and analyze industrial entities, and extract their core attribute information; Based on the entity attribute information and in accordance with the Industrial Internet Identification Encoding Rules, an Industrial Internet Identification Code is generated and stored in the Identification Resolution Node; The data provider undergoes real-name authentication and qualification verification. If both are compliant, a corresponding blockchain node is constructed and a blockchain wallet address is generated. The blockchain wallet address is associated with the identity information of the data provider, and after consensus is reached through smart contracts, the data is stored on the blockchain. Fields are added based on the identifier resolution node, and associated with the blockchain wallet address of the smart contract to build a mapping relationship table, generate mapping credentials, and store them on the blockchain.

3. The industrial trusted data cross-chain management method according to claim 1, characterized in that, Based on the allocation of industrial internet identification codes to industrial entities, combined with blockchain wallet addresses, a mapping certificate is generated and stored on the blockchain, which also includes: Entity attribute information is detected and compared according to the event monitoring cycle; If the entity attribute information changes, the industrial internet identifier code is updated according to the identifier resolution node, a new mapping certificate is generated, and the smart contract is triggered to verify the data management authority. After the verification is successful, the new mapping certificate is synchronized to the blockchain for storage.

4. The industrial trusted data cross-chain management method according to claim 1, characterized in that, The process of sending and standardizing the original industrial data according to the cross-chain sharing request, combined with the mapping certificate, to form a cross-chain data packet includes: The identifier resolution node performs permission verification on the blockchain wallet address and mapping credential corresponding to the cross-chain sharing request; If a valid mapping relationship exists for the current blockchain wallet address, and the mapping certificate has not expired or been revoked, then the cross-chain sharing request will be parsed to extract the original industrial data. The original industrial data is parsed according to the encoding rules of the Industrial Internet Identifier Code, and data attribute elements including data type, scenario, sharing scope and collection timestamp are extracted. The data attribute elements, the original industrial data, the mapping certificate, and the industrial internet identification code are standardized and encapsulated to form an initial data packet; Perform multi-dimensional verification on the initial data packet to calculate data integrity and data packet usage; If the data integrity is greater than the preset integrity threshold and the data packet occupancy is less than or equal to the preset transmission limit threshold, then the initial data packet is encrypted to form a cross-chain data packet.

5. The industrial trusted data cross-chain management method according to claim 1, characterized in that, The process of receiving and verifying the cross-chain data packet based on the data access request and the smart contract, and extracting trusted industrial data, includes: Parse the data access request to extract the recipient's digital signature and the target wallet address; If the recipient's digital signature verification is valid, the target wallet address is checked and matched according to the data sharing permission table; If the current blockchain wallet address is successfully matched, the target Internet identifier is queried according to the mapping relationship table to obtain the off-chain storage location of the cross-chain data packet; A secure transmission channel is established by connecting the off-chain storage location with the recipient's location based on the smart contract; The cross-chain data packet is transmitted according to the secure transmission channel, and a proof hash value is provided; The cross-chain data packets are analyzed, the data packet hash value is calculated, and compared with the evidence storage hash value; If the two are the same, it indicates that the current cross-chain data packet has not been tampered with and is temporarily stored in the security buffer. The cross-chain data packet is decrypted to extract the industrial internet identifier code, and then parsed in conjunction with the identifier resolution node to extract the original industrial data; The original industrial data and its corresponding attribute tags are associated to form reliable industrial data.

6. The industrial trusted data cross-chain management method according to claim 1, characterized in that, The process of allocating and updating data management permissions according to the preset permission control rule template and data usage scenarios, and regulating industrial trusted data, includes: Based on business objectives, data usage scenarios are classified and collected to form a data application framework; Based on the data application skeleton, permissions are assigned to data callers to form a permission control rule template; Based on the permission configuration object, select several industrial internet identification codes and combine them with the permission control rule template to generate a permission policy object; The smart contract performs on-chain notarization and signature verification on the permission policy object and returns the notarized hash value of the permission. The permission storage hash value is decomposed to obtain object-specific identifiers of different levels, and each item is verified according to the four-level permission layer. If any level of validation fails, the smart contract rejects the access request and logs the failure. If all passes, then based on the data field level permissions, the allowed access fields in the cross-chain data packet are filtered to generate a restricted dataset, which is then transmitted to the data receiver through a secure transmission channel, and the access log is recorded. If the data provider's business changes, the identifier resolution node verifies the data provider's identity, initiates a permission update request, and resubmits the new permission control rules to the smart contract, overriding the old permission control rules and storing them on the blockchain, thus completing the permission control of industrial trusted data. If the current access control rule is pending revocation, the data provider calls the smart contract's revocation access method to revoke the data caller's authorization in real time, thus completing the access control of industrial trusted data.

7. The industrial trusted data cross-chain management method according to claim 6, characterized in that, The access control rule template includes: Based on the data management dimensions, the permission rules are layered to obtain a hierarchical permission control framework; The hierarchical permission control skeleton is subjected to feature parsing to extract the rule permission data structure; Based on the rule permission data structure and the permission rule mapping table, the permission rule set is associated to generate a scenario permission policy; Based on the scenario permission policy, the preset data application scenario template is structurally modified to generate permission rule objects; According to the smart contract's registration permission mechanism, the permission rule object is stored on the blockchain and the storage transaction hash is returned. Based on the evidence storage transaction hash and the permission verification function, the permission rule object is merged to generate a permission control rule template.

8. The industrial trusted data cross-chain management method according to claim 1, characterized in that, The industrial trusted data cross-chain management method also includes: Internet identifier logs are used to monitor the cross-chain data sharing behavior of smart contracts, and combined with the blockchain ledger of identifier resolution nodes to form a data flow trajectory log; The data flow logs are analyzed to extract abnormal application behaviors and, in conjunction with the source tracing and auditing rules, the data control permissions of the data caller are marked as pending revocation.

9. An industrial trusted data cross-chain management and control system, used to implement the method as described in any one of claims 1-8, characterized in that, include: The mapping establishment module is used to assign industrial internet identification codes to industrial entities, combine them with blockchain wallet addresses to generate mapping credentials and store them on the blockchain. The cross-chain encapsulation module is used to send and standardize the original industrial data according to the cross-chain sharing request, and combine it with the mapping certificate to form a cross-chain data packet; The data interaction module is used to receive and verify the cross-chain data packets and extract trusted industrial data based on data access requests and smart contracts. The access control module is used to allocate and update data management permissions according to preset access control rule templates and data usage scenarios, thereby regulating trusted industrial data. The behavior monitoring module is used to monitor the Internet identifier logs of smart contract data cross-chain sharing behavior, and combine them with the blockchain ledger of the identifier resolution node to form a data flow trajectory log. The source tracing and auditing module is used to parse the data flow trajectory log, extract abnormal application behaviors, and, in conjunction with source tracing and auditing rules, mark the data control permissions of the data caller as pending revocation.

10. A storage medium storing at least one instruction, at least one program, a code set, or an instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the industrial trusted data cross-chain management method as described in any one of claims 1 to 8.

Images