Health status determination system, method, and electronic device for an object to be evaluated

Abstract

This invention relates to the fields of industrial big data processing and artificial intelligence technology, and discloses a system, method, and electronic device for determining the health status of an object to be evaluated. The system includes: using a data push module to send an evaluation operator package to the edge computing node of the object to be evaluated; using a proof service module to obtain a proof report sent by the edge computing node, verifying the evaluation operator package based on the proof report, and generating a verification result; using a data management module to obtain data elements sent by the evaluation operator package, updating the digital twin based on the data elements, and obtaining an update summary; using a health assessment module to generate a health assessment report of the object to be evaluated based on the updated digital twin; and using a notarization module to notarize the verification result and the update summary. This invention solves the problem that when quantitatively assessing the comprehensive health status of an enterprise, it is difficult to verify the computing logic running in the enterprise's local environment and notarize the verification results, thus making it difficult to ensure enterprise data security.

Description

Technical Field

[0001] This invention relates to the fields of industrial big data processing and artificial intelligence technology, specifically to a system, method, and electronic device for determining the health status of an object to be evaluated. Background Technology

[0002] As enterprises deepen their digital transformation, the need for quantitative assessment of their overall health status is becoming increasingly urgent. Currently, when conducting quantitative assessments of an enterprise's overall health status, the raw operational data required for the assessment often involves the enterprise's core trade secrets. Enterprises' security requirements for raw operational data are that the data is usable but not visible; that is, anonymizing calculations of the raw operational data are permitted, but the raw operational data is prohibited from leaving the domain.

[0003] Currently, to protect the security of raw operational data, enterprises are choosing to offload computation logic to the enterprise side. However, while some solutions for offloading computation logic to the enterprise side include privacy-preserving computation technologies based on trusted execution environments (TEAs) that can provide hardware isolation protection for raw operational data, these solutions all focus on a single privacy-preserving computation stage. Enterprises cannot verify whether the computation logic running in the local environment contains backdoor logic or unauthorized data sniffing instructions, nor can they verify the computation logic and ensure that the verification results are stored as tamper-proof third-party evidence, making it difficult to guarantee the security of raw operational data. Summary of the Invention

[0004] This invention provides a system, method, and electronic device for determining the health status of an object to be evaluated, in order to solve the problem that when quantitatively assessing the overall health status of an enterprise, it is difficult to verify the computational logic running in the enterprise's local environment and to store the verification results, thus making it difficult to ensure the security of enterprise data.

[0005] In a first aspect, the present invention provides a system for determining the health status of an object to be evaluated, the system comprising: a data push module, a proof service module, a data management module, a health assessment module, and a proof storage module; The data push module is used to determine the evaluation operator package corresponding to the object to be evaluated and to send the evaluation operator package to the edge computing node of the object to be evaluated; The proof service module is used to obtain the proof report sent by the edge computing node, determine the runtime fingerprint of the evaluation operator package based on the proof report, compare the runtime fingerprint with the initial fingerprint, generate the verification result based on the comparison result, and transmit the verification result to the proof storage module. The proof report is generated by the edge computing node based on the evaluation operator package and the identification information. The data management module is used to acquire data elements sent by the evaluation operator package in the edge computing node, update the digital twin according to the data elements, obtain the updated digital twin and the update summary, and transmit the update summary to the evidence storage module. The data elements are generated by the evaluation operator package based on the original operation data in the hardware isolation area of ​​the edge computing node when the verification result is successful. The health assessment module is used to generate a health assessment report for the subject to be assessed based on the updated digital twin. The evidence storage module is used to store the verification results and update summaries.

[0006] The health status determination system for the object to be evaluated provided in this embodiment utilizes a data push module to distribute the evaluation operator package corresponding to the object to be evaluated to the edge computing node of the object to be evaluated; a proof service module obtains the proof report sent by the edge computing node, verifies the evaluation operator package based on the proof report, and generates a verification result; a data management module obtains the data elements sent by the evaluation operator package in the edge computing node, updates the digital twin based on the data elements, and obtains the updated digital twin and an update summary; a health evaluation module generates a health evaluation report for the object to be evaluated based on the updated digital twin; and a notarization module notarizes the verification result and the update summary. In terms of data security, this system, through trusted execution environment hardware isolation and remote proof mechanisms, ensures that the original operational data of the object to be evaluated does not leave the domain at the physical level, and the security and trustworthiness of external operators can be independently verified by the enterprise. The remote proof result is written to the blockchain in real time, giving the verification record immutable and permanent traceability. This solves the problem that when quantitatively evaluating the comprehensive health status of an enterprise, it is difficult to verify the computing logic running in the enterprise's local environment and notarize the verification results, thus making it difficult to guarantee enterprise data security.

[0007] In one optional implementation, the proof service module includes: a verification result generation unit and an exception handling unit; The verification result generation unit is used to compare the runtime fingerprint with the initial fingerprint, obtain the comparison result, acquire the verification timestamp, and generate the verification result based on the verification timestamp, runtime fingerprint, initial fingerprint, and comparison result. The exception handling unit is used to send an operator stop running instruction to the edge computing node when the runtime fingerprint is different from the initial fingerprint. Based on the verification timestamp, runtime fingerprint and comparison result, a verification failure event is generated. The operator stop running instruction is used to instruct the edge computing node to stop loading and executing the evaluation operator package. The evidence storage module is used to store evidence of verification failure events.

[0008] In this implementation, at the data security level, relying on the trusted execution environment's hardware isolation and remote verification mechanism, the original operational data of the enterprise is physically kept within its domain, and the security of external operators can be independently verified by the enterprise. The hardware isolation zone immediately performs memory erasure after data elements are generated and transmitted back, eliminating the risk of residual original data at the physical level. Remote verification results are written to the blockchain in real time, ensuring the verification record is immutable and permanently traceable. Verification failure triggers a security block, significantly improving the system's robustness in handling anomalies. Furthermore, the trusted execution environment's remote verification and blockchain notarization form a two-way synergistic enhancement. The former provides hardware-level trusted source protection, while the latter ensures the immutability of records. Together, they construct a closed loop of trusted source generation and immutable records, breaking through the limitations of single technologies and comprehensively strengthening data security and audit credibility.

[0009] In one optional implementation, the data management module includes: a first data processing unit, a second data processing unit, and a digital twin management unit; The first data processing unit is used to generate a knowledge graph ontology based on a preset indicator system, and adjust the data elements based on the knowledge graph ontology to obtain the first intermediate data. The second data processing unit is used to adjust the update frequency of the first intermediate data according to a preset event window to obtain the second intermediate data. The digital twin management unit is used to inject the second intermediate data into the digital twin, obtain the version snapshot and update summary corresponding to the digital twin, and obtain the updated digital twin based on the version snapshot.

[0010] In this implementation, semantic alignment of multi-source heterogeneous data is achieved through knowledge graphs, and spatiotemporal consistency synchronization is accomplished by relying on event windows, accurately constructing and dynamically updating the enterprise's digital twin. Each update of the twin generates a timestamped version snapshot and summary, and the summary fingerprint is stored on the blockchain for evidence, forming an interlocking guarantee with the blockchain. This effectively detects unauthorized tampering, establishes an immutable evolutionary audit trajectory, and provides a trusted unified computing foundation for enterprise health assessment and risk prediction.

[0011] In one optional implementation, the system further includes: a contract management module; The contract management module is used to receive service adjustment instructions from the object to be evaluated, and to determine the target service and authorized changes based on the service adjustment instructions; The contract management module is also used to determine the data element subset and evaluation operator list corresponding to the target service, and to generate a contract revision draft based on the authorized changes. The data element subset and evaluation operator list are used to determine the evaluation operator package. The contract management module is also used to activate or block the data link corresponding to the draft contract revision when the object to be evaluated completes digital signing of the draft contract revision. The contract management module is also used to block the data access path and operator execution permissions of the target service if the object to be evaluated refuses to sign the draft contract revision. The evidence storage module is used to store the draft amendments to the contract.

[0012] In this implementation, the contract management module enables automatic contract derivation, differential review, and digital signing for service adjustments. After signing, the corresponding data link is activated / blocked, and if rejected, version isolation is performed to ensure the normal operation of the original service. The entire contract process is recorded on the blockchain in real time, realizing dynamic synchronization between data authorization and business evolution. This completely eliminates governance blind spots of over-authorization and under-authorization, allowing data authorization to accurately adapt to business changes and improving the flexibility and security of authorization governance.

[0013] In one optional implementation, the system further includes: an instruction processing module for the object to be evaluated; The object to be evaluated instruction processing module is used to receive operation instructions sent by the object to be evaluated, obtain the administrator identity authentication information of the object to be evaluated, and execute the operation instructions if the administrator identity authentication information is verified. The object to be evaluated instruction processing module is also used to determine the data to be erased corresponding to the physical deletion instruction and erase the data to be erased when the operation instruction is a physical deletion instruction.

[0014] In this implementation, a sovereign operation interface is provided through the instruction processing module of the object to be evaluated. After multi-factor authentication and verification, operations such as deletion and migration are performed to ensure the enterprise's complete sovereign control over cloud data and digital twins. After physical deletion, a destruction certificate is generated according to a four-stage process. Relying on zero-knowledge proofs and blockchain notarization, on-chain proof and off-chain physical deletion are realized. Hardware signatures ensure the authenticity of erased metadata and prevent forgery, providing cryptographically verifiable protection for data sovereignty.

[0015] In one optional implementation, the instruction processing module for the object to be evaluated includes: a physical erasure unit, a destruction credential generation unit, a certificate storage unit, and a data transmission unit; The physical erasure unit is used to perform erasure operations on the data to be erased, determine the metadata corresponding to the erasure operation, and digitally sign the metadata. The destruction credential generation unit is used to generate encrypted destruction credentials based on the metadata of the completed digital signature, preset statement information, and preset proof protocol. The evidence storage unit is used to generate a cryptographic fingerprint of the encrypted destruction certificate, obtain the operation timestamp and operation initiator identifier of the erasure operation, and transmit the cryptographic fingerprint, operation timestamp and operation initiator identifier to the evidence storage module so that the evidence storage module can store the cryptographic fingerprint, operation timestamp and operation initiator identifier. The data sending unit is used to send the encrypted destruction certificate, preset statement information and preset key to the object to be evaluated, so that the object to be evaluated can determine whether the data to be erased has been physically erased.

[0016] In this implementation, physical erasure of the data is performed, and trusted hardware signs the erased metadata. An encrypted destruction credential is generated based on zero-knowledge proofs, and the credential fingerprint and other information are stored on the blockchain as evidence. This achieves a cross-level trusted mapping from off-chain physical erasure to on-chain cryptographic evidence. Enterprises can independently verify the deletion results without needing to know the cloud architecture. Hardware signatures prevent forgery from the source, effectively solving the technical challenge of on-chain proof of off-chain physical deletion.

[0017] In one optional implementation, the system further includes: a function expansion module; The functional extension module is used to determine whether a risk signal has been detected based on the digital twin of the object to be evaluated; The functional extension module is also used to generate a disturbance factor based on the risk signal when a risk signal is detected, and to determine the downstream objects of the object to be evaluated. The functional extension module is also used to inject disturbance factors into the digital twin of downstream objects to obtain target digital twins, perform asymmetric stress test simulations based on target digital twins, obtain simulation results, and generate early warning reports based on simulation results. The early warning reports are used to determine the magnitude of the impact of the object to be evaluated on downstream objects.

[0018] In this implementation, risk signals from upstream enterprises are detected by digital twins. Differential privacy is used to convert risks into encrypted perturbation factors without leaking the original data. The perturbation factors are injected into the downstream twin to conduct stress tests and generate early warning reports. Under the premise of strictly adhering to data sovereignty boundaries, the impact of supply chain risk transmission is accurately assessed, and risk early warning for cross-organizational privacy and security is achieved.

[0019] In one optional implementation, the evidence storage module includes: an evidence storage record generation unit and an evidence storage unit; The evidence storage record generation unit is used to generate evidence storage records based on the operation type corresponding to the operation instruction, the operation initiator identifier, the operation object identifier, the operation timestamp, and the cryptographic digest of the operation result. The evidence storage unit is used to write evidence storage records into the blockchain in the form of transactions. The blockchain contains multiple on-chain nodes corresponding to multiple users.

[0020] In this implementation, blockchain full lifecycle evidence storage covers all key aspects such as contract governance, operator verification, sovereign operation, certificate destruction, and twin update, transforming the traditional black-box model of data processing into a white-box model that enterprises can audit and intervene at any time.

[0021] Secondly, the present invention provides a method for determining the health status of an object to be evaluated, the method comprising: Determine the evaluation operator package corresponding to the object to be evaluated, and distribute the evaluation operator package to the edge computing node of the object to be evaluated; Obtain the proof report sent by the edge computing node, determine the runtime fingerprint of the evaluation operator package based on the proof report, compare the runtime fingerprint with the initial fingerprint, and generate the verification result based on the comparison result. The proof report is generated by the edge computing node based on the evaluation operator package and the identification information. The data elements sent by the evaluation operator package in the edge computing node are obtained, and the digital twin is updated according to the data elements to obtain the updated digital twin and the update summary. The data elements are generated by the evaluation operator package based on the original operation data in the hardware isolation area of ​​the edge computing node when the verification result is successful. Based on the updated digital twin, generate a health assessment report for the subject to be evaluated; The verification results and updated summaries are stored as evidence.

[0022] The method for determining the health status of an object to be evaluated provided in this embodiment, in terms of data security, achieves this by using trusted execution environment hardware isolation and remote verification mechanisms. This ensures that the original operational data of the object to be evaluated does not leave the domain at the physical level, and the security and trustworthiness of external operators can be independently verified by the enterprise. The remote verification results are written to the blockchain in real time, giving the verification records immutable and permanent traceability. This solves the problem that when quantitatively assessing the comprehensive health status of an enterprise, it is difficult to verify the computational logic running in the enterprise's local environment and to store the verification results, thus making it difficult to guarantee the enterprise's data security.

[0023] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for determining the health status of the object to be evaluated as described in the second aspect or any corresponding embodiment above. Attached Figure Description

[0024] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of a first structure of a system for determining the health status of an object to be evaluated according to an embodiment of the present invention. Figure 2 This is a schematic diagram of a second structure of a system for determining the health status of an object to be evaluated according to an embodiment of the present invention. Figure 3 This is a flowchart illustrating a method for determining the health status of an object to be evaluated according to an embodiment of the present invention. Figure 4 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0028] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0029] Currently, there is an increasingly urgent need for quantitative assessments of a company's overall health, which includes dimensions such as financial soundness, production efficiency, environmental compliance, and supply chain resilience. Existing assessment systems include environmental, social, and governance (ESG) rating frameworks or comprehensive health index models, but these systems suffer from the following problems: The credibility of data sources is insufficient. Existing systems rely heavily on proactive reporting by enterprises or periodic reports from third-party auditing firms, lacking automated mechanisms for collecting and verifying the authenticity of original records from source operating systems (such as enterprise resource planning systems, manufacturing execution systems, customer relationship management systems, and data acquisition and monitoring systems). This makes it difficult to effectively curb data manipulation and "greenwashing" from a technical perspective, compromising the credibility of assessment results.

[0030] There is a structural contradiction between privacy protection and data utilization. The raw operational data required for assessment often involves core business secrets. Enterprises' bottom-line requirement is that data is usable but not visible; that is, anonymized computations are allowed, but the original data is prohibited from leaving the domain. Current solutions that push computation logic down to the enterprise side, while offering hardware isolation protection through privacy-preserving computation technologies based on trusted execution environments, focus on a single privacy-preserving computation stage. They fail to create a systematic closed loop by integrating operator integrity verification with subsequent data element fusion, digital twin construction, and full lifecycle auditing. Enterprises cannot verify whether external operators running in their local environment contain backdoor logic or unauthorized data sniffing instructions, and operator verification results lack tamper-proof third-party verification.

[0031] The lack of control over data sovereignty is a significant issue. Once raw data or its derivatives leave the enterprise boundary and enter the cloud platform, the enterprise lacks effective technical guarantees regarding its real-time viewing rights, disposal rights (including migration and deletion), and the verifiability of the destruction results. Existing solutions typically only return simple operation logs after data deletion is performed in the cloud. Although zero-knowledge proof technology has been proposed for verifiable data deletion scenarios, and blockchain evidence storage technology can provide tamper-proof audit traceability, there is currently no complete technical solution to transform physical data erasure operations into cryptographic destruction credentials using zero-knowledge proofs and to write the fingerprint of these credentials into the blockchain in real time for tamper-proof evidence storage. In other words, existing blockchain evidence storage systems typically store hash evidence of data generation or data flow, but cannot prove the reverse proposition that data in off-chain physical storage has been irreversibly erased. This is the technical essence of the physical erasure verifiability problem.

[0032] The licensing governance is disconnected from business evolution. Data usage licenses between enterprises and platforms are typically signed once at the beginning of the cooperation and remain unchanged for a long period. When the platform launches new analytics services or the enterprise adjusts its subscription scope, the corresponding data licensing boundaries cannot be adjusted in real time and automatically to keep up with business changes, resulting in the long-term coexistence of over-licensing and under-licensing issues.

[0033] Privacy barriers exist in cross-organizational ecosystem collaboration. Due to the highly sensitive nature of each enterprise's core operational data, scenarios such as cross-enterprise industry benchmarking and supply chain risk assessment face significant privacy hurdles. While existing federated learning solutions offer privacy protection at the model parameter level, and secure aggregation protocols further prevent gradient backpropagation risks, they lack a systematic integration solution with the aforementioned assessment systems, data sovereignty governance, and blockchain auditing mechanisms.

[0034] To address the aforementioned technical challenges, this invention proposes a multi-dimensional enterprise health assessment and risk prediction system and method based on blockchain and a trusted data space. This system constructs a full lifecycle data governance architecture that ensures computational logic is routed to the source, operator integrity is hardware-anchored, derived element sovereignty is real-time visible, and destruction credentials are cryptographically verified and stored on the blockchain. Under the premise that core enterprise data remains within the domain, this system enables multi-dimensional digital twin modeling of enterprise operational status, dynamic health assessment, industry benchmarking, and supply chain risk prediction.

[0035] It should be noted that the multidimensional assessment used in this invention refers to a comprehensive quantitative assessment based on full time-space data mapping, covering multiple business dimensions such as corporate financial health, operational efficiency, market competitiveness, environmental compliance, and supply chain resilience. The multidimensional indicator system used in this invention refers to a structured set of core feature parameters composed of the aforementioned multiple business dimensions and their subordinate multi-level subdivided quantitative indicators. The hardware isolation zone used in this invention refers to a hardware-level security isolation execution area provided by the processor, such as a processor enclave isolation zone or an isolation zone based on the processor's security world. The internal code and data of the hardware isolation zone are not visible even to the operating system or virtual machine manager.

[0036] According to an embodiment of the present invention, a system for determining the health status of an object to be evaluated is provided. It should be noted that the system can run on a computer system such as a set of computer-executable instructions, for example, a computer, a server, etc.

[0037] This embodiment provides a system for determining the health status of an object to be evaluated. Figure 1 This is a schematic diagram of the structure of a system for determining the health status of an object to be evaluated according to an embodiment of this application, such as... Figure 1 As shown, the system includes: a data push module, a proof service module, a data management module, a health assessment module, and a proof storage module; The data push module is used to determine the evaluation operator package corresponding to the object to be evaluated and to send the evaluation operator package to the edge computing node of the object to be evaluated; The proof service module is used to obtain the proof report sent by the edge computing node, determine the runtime fingerprint of the evaluation operator package based on the proof report, compare the runtime fingerprint with the initial fingerprint, generate the verification result based on the comparison result, and transmit the verification result to the proof storage module. The proof report is generated by the edge computing node based on the evaluation operator package and the identification information. The data management module is used to acquire data elements sent by the evaluation operator package in the edge computing node, update the digital twin according to the data elements, obtain the updated digital twin and the update summary, and transmit the update summary to the evidence storage module. The data elements are generated by the evaluation operator package based on the original operation data in the hardware isolation area of ​​the edge computing node when the verification result is successful. The health assessment module is used to generate a health assessment report for the subject to be assessed based on the updated digital twin. The evidence storage module is used to store the verification results and update summaries.

[0038] Specifically, the data push module, for example: Figure 2 The hardware-controlled service push module. Data management module, for example: Figure 2 A centralized, multi-dimensional management engine based on a trusted data space. The evidence storage module, for example: Figure 2 The blockchain full lifecycle audit module, along with the data push module, data management module, and evidence storage module, together constitute the core architecture of the system.

[0039] The core design concept of the data push module is to move computation to data, that is, the system will proactively push the processing operators required for evaluation to the enterprise's local data source side for execution, rather than requiring the enterprise to upload the raw data to the cloud.

[0040] The objects to be evaluated include, for example, enterprises and organizations requiring comprehensive quantitative assessment of their health status. The data push module determines the corresponding assessment operator package for the object to be evaluated. For example, based on the data subset and processing scope defined by the contract using currently effective data, the module selects the corresponding assessment operator package from the operator repository on the central side. The assessment operator package is then distributed to the edge computing nodes of the object to be evaluated via an encrypted transmission channel. These edge computing nodes may be, for example, locally deployed edge computing nodes within the enterprise.

[0041] In the trusted execution phase, all operators pushed to the local machine must run in the trusted execution environment configured locally by the enterprise. The trusted execution environment provides hardware isolation zones to ensure the confidentiality and integrity of code and data.

[0042] Before the operator is loaded into the hardware isolation zone, the edge computing node system performs a remote verification process. For example, the trusted execution environment hardware in the edge computing node generates a verification report containing the isolation zone code metric and the signer identity metric. This verification report is signed by the hardware's built-in verification key and sent to the verification service module for verification. The verification report is generated by the edge computing node based on the evaluated operator package and identification information, including the aforementioned isolation zone code metric and signer identity metric.

[0043] The proof service module can provide independent remote proof services. It acquires proof reports sent by edge computing nodes, determines the runtime fingerprint of the evaluation operator package based on the report, compares the runtime fingerprint with the initial fingerprint, and generates a verification result based on the comparison result. This remote proof service rigorously compares the operator's actual runtime fingerprint (i.e., the cryptographic digest of the code and initial data) with the standard fingerprint confirmed by the user during the contract signing phase. The operator is only allowed to start execution within the hardware isolation zone if the two are completely identical. This mechanism ensures at the hardware physical level that the operator does not contain backdoor logic or unauthorized data sniffing instructions.

[0044] The verification results of remote proof include a verification timestamp, operator fingerprint value, and verification pass / fail status. The verification results of remote proof are transmitted to the evidence storage module for on-chain evidence storage, thereby ensuring that the operator's credibility is not only verifiable at the time of verification but also traceable and tamper-proof afterward.

[0045] In the element generation stage, assuming the verification result is successful, the operators in the evaluation operator package perform predefined desensitization, aggregation, and feature extraction operations on the enterprise's original operational data within the hardware isolation zone of the edge computing node, generating non-sensitive data elements. Examples of original operational data include: financial transaction records from an Enterprise Resource Planning (ERP) system, real-time production line parameters from a Manufacturing Execution System (MES), and customer transaction summaries from a Customer Relationship Management (CRM) system. Each data element carries an integrity tag signed by the trusted execution environment hardware and is subsequently transmitted back to the central side via an encrypted channel. Immediately after data element generation and transmission, the system performs a memory erase operation on the hardware isolation zone, clearing all temporarily stored enterprise original data from physical memory, ensuring that the original data does not leave the physical domain.

[0046] The data management module acquires data elements sent by the evaluation operator packets in the edge computing nodes. It writes these data elements into the digital twin to update it, obtaining the updated digital twin and an update summary. The update summary is then transmitted to the evidence storage module for on-chain evidence storage, thereby establishing an immutable audit trail of the digital twin's evolution history.

[0047] The health assessment module generates a health assessment report for the subject based on the updated digital twin. For example, the health assessment module performs health assessment calculations based on the updated digital twin, outputs a comprehensive score and sub-scores for each dimension, and generates a visual health assessment report.

[0048] Alternatively, the process for generating a health assessment report can also be as follows: Through a standardized output interface provided by the system, the multi-dimensional assessment indicators output by the digital twin are standardized and transformed into risk quantification assessment parameters. These parameters can then be used as input data to trigger automated resource allocation logic pre-deployed on a permissioned blockchain via a blockchain smart contract interface. The resource allocation logic automatically calculates and outputs the corresponding risk level assessment value or compliance incentive control coefficient according to preset parameter mapping rules, and pushes the calculation results to relevant external systems in a verifiable manner.

[0049] The evidence storage module is the infrastructure that links the critical operational events of various system components into a complete and trustworthy audit chain. It is responsible for the immutable on-chain evidence storage of critical operational events during system operation. The evidence storage module is used to store verification results and update summaries.

[0050] The health status determination system for the object to be evaluated provided in this embodiment utilizes a data push module to distribute the evaluation operator package corresponding to the object to be evaluated to the edge computing node of the object to be evaluated; a proof service module obtains the proof report sent by the edge computing node, verifies the evaluation operator package based on the proof report, and generates a verification result; a data management module obtains the data elements sent by the evaluation operator package in the edge computing node, updates the digital twin based on the data elements, and obtains the updated digital twin and an update summary; a health evaluation module generates a health evaluation report for the object to be evaluated based on the updated digital twin; and a notarization module notarizes the verification result and the update summary. In terms of data security, this system, through trusted execution environment hardware isolation and remote proof mechanisms, ensures that the original operational data of the object to be evaluated does not leave the domain at the physical level, and the security and trustworthiness of external operators can be independently verified by the enterprise. The remote proof result is written to the blockchain in real time, giving the verification record immutable and permanent traceability. This solves the problem that when quantitatively evaluating the comprehensive health status of an enterprise, it is difficult to verify the computing logic running in the enterprise's local environment and notarize the verification results, thus making it difficult to guarantee enterprise data security.

[0051] As an optional embodiment, the proof service module includes: a verification result generation unit and an exception handling unit; The verification result generation unit is used to compare the runtime fingerprint with the initial fingerprint, obtain the comparison result, acquire the verification timestamp, and generate the verification result based on the verification timestamp, runtime fingerprint, initial fingerprint, and comparison result. The exception handling unit is used to send an operator stop running instruction to the edge computing node when the runtime fingerprint is different from the initial fingerprint. Based on the verification timestamp, runtime fingerprint and comparison result, a verification failure event is generated. The operator stop running instruction is used to instruct the edge computing node to stop loading and executing the evaluation operator package. The evidence storage module is used to store evidence of verification failure events.

[0052] Specifically, before loading the operators in the evaluation operator package into the hardware isolation zone, the edge computing node system performs a remote proof process, including: the trusted execution environment hardware in the edge computing node generates a proof report containing the isolation zone code metric and the signer identity metric. This proof report is signed by the hardware-built-in proof key and sent to a separate proof service module for verification.

[0053] The proof service module determines the runtime fingerprint (i.e., the cryptographic digest of the code and initial data) of the evaluation operator package based on the proof report, and obtains the standard fingerprint, i.e. the initial fingerprint, confirmed by the object to be evaluated during the contract signing phase.

[0054] The verification result generation unit compares the runtime fingerprint with the initial fingerprint to obtain the comparison result. Only when the two are completely consistent is the operator allowed to start execution in the hardware isolation area.

[0055] The verification result generation unit obtains the verification timestamp and, based on the timestamp, runtime fingerprint, initial fingerprint, and comparison results, generates a remote proof verification result, including the verification timestamp, operator fingerprint value, and verification pass / fail status. The verification result is submitted to the blockchain audit module in real time for on-chain notarization, ensuring that the operator's credibility is not only verifiable at the time of verification but also traceable and tamper-proof afterward. This mechanism ensures at the hardware physical level that the operator does not contain backdoor logic or unauthorized data sniffing instructions.

[0056] The exception handling unit implements the exception handling mechanism. If remote verification fails (i.e., the runtime fingerprint differs from the initial fingerprint), the system immediately triggers a security blocking process, sending an operator stop command to the edge computing node. This command prevents the operator from being loaded and executed within the hardware isolation zone, shuts down the current data processing pipeline, and simultaneously sends security alerts to the enterprise authorized administrator and the central security operations center. Based on the verification timestamp, runtime fingerprint, and comparison results, a verification failure event (including the failure reason, abnormal fingerprint value, and timestamp) is generated.

[0057] The verification failure event is recorded in the evidence storage module for preservation. The operator push and proof process can only be restarted after the security team has investigated and fixed the cause of the anomaly.

[0058] In this embodiment, at the data security level, relying on the trusted execution environment hardware isolation and remote proof mechanism, the original operational data of the enterprise is physically kept within its domain, and the security of external operators can be independently verified by the enterprise. The hardware isolation zone immediately performs memory erasure after data elements are generated and transmitted back, eliminating the risk of residual original data at the physical level. The remote proof result is written to the blockchain in real time, ensuring the verification record is immutable and permanently traceable. A security block is triggered upon verification failure, significantly improving the system's robustness in handling anomalies. Furthermore, the trusted execution environment remote proof and blockchain notarization form a two-way synergistic enhancement. The former provides hardware-level trusted source protection, while the latter ensures the immutability of records. Together, they construct a closed loop of trusted source generation and immutable records, breaking through the limitations of single technologies and comprehensively strengthening data security and audit credibility.

[0059] As an optional embodiment, the data management module includes: a first data processing unit, a second data processing unit, and a digital twin management unit; The first data processing unit is used to generate a knowledge graph ontology based on a preset indicator system, and adjust the data elements based on the knowledge graph ontology to obtain the first intermediate data. The second data processing unit is used to adjust the update frequency of the first intermediate data according to a preset event window to obtain the second intermediate data. The digital twin management unit is used to inject the second intermediate data into the digital twin, obtain the version snapshot and update summary corresponding to the digital twin, and obtain the updated digital twin based on the version snapshot.

[0060] Specifically, the data management module is responsible for receiving data elements from the trusted execution environment at the edge of each enterprise, and for completing the fusion of multi-source heterogeneous elements and the construction of the enterprise digital twin within the trusted data space framework.

[0061] The preset indicator system is a unified multi-dimensional indicator system, such as covering primary dimensions like financial health, operational efficiency, market competitiveness, environmental compliance, and supply chain resilience, as well as their subordinate multi-level sub-indicators. To process data elements and ensure they meet semantic ontology alignment requirements, the first data processing unit generates a knowledge graph ontology based on the preset indicator system. For example, it constructs and maintains an enterprise-level knowledge graph, which uses the unified multi-dimensional indicator system as its target ontology.

[0062] The data elements are heterogeneous data elements from different operating systems. For example, the financial elements output by the Enterprise Resource Planning system are encoded using Extensible Business Reporting Language, the production elements output by the Manufacturing Execution System use the Industrial Communication Unified Architecture Data Model, and the market elements output by the Customer Relationship Management System use a custom structure.

[0063] To ensure that data elements meet semantic ontology alignment requirements, the data elements are adjusted according to the knowledge graph ontology to obtain the first intermediate data. For example, by using a deep semantic matching model, the system automatically completes the entity alignment and relationship mapping of data elements from the source semantics to the target ontology of the multi-dimensional indicator system, thus obtaining the first intermediate data. For fields with a matching confidence score lower than a preset threshold, the system generates a manual review marker and pushes it to domain experts for confirmation.

[0064] Because data elements from different operating systems have different update frequencies—for example, financial elements are updated monthly or quarterly, production line elements are updated every second or minute, and market elements are updated daily—data elements need to be processed to meet the requirements of spatiotemporal consistency and synchronization.

[0065] The second data processing unit employs an event-window-based asynchronous synchronization mechanism. This mechanism uses business events as synchronization triggers rather than polling at fixed time periods. Examples of business events include: monthly settlement completion, production line batch completion, and quarterly revenue release.

[0066] The second data processing unit adjusts the update frequency of the first intermediate data according to the preset event window to obtain the second intermediate data. For example, within the event window, high-frequency elements are downsampled and aggregated using time-weighted moving average or linear interpolation algorithms, while low-frequency elements are filled to the target time granularity through previous value filling or predictive interpolation, and finally all elements are aligned to a unified time baseline.

[0067] In terms of digital twin management, the digital twin management unit injects second intermediate data, after semantic alignment and spatiotemporal synchronization, into the digital twin specific to the object to be evaluated to update the digital twin. Each update to the digital twin's state generates a timestamped version snapshot and update summary for the corresponding digital twin, and the updated digital twin can be obtained based on the version snapshot.

[0068] The updated digital twin operates within a trusted data space, which is protected through multi-level access control policies. The digital twin mirrors the enterprise's operational health in real time and serves as a unified computing platform for subsequent assessments, predictions, and simulations.

[0069] In addition, a fingerprint of the updated summary can be generated and submitted to the blockchain audit module for on-chain evidence storage, thereby establishing an immutable audit trail of the twin's evolutionary history.

[0070] In this embodiment, semantic alignment of multi-source heterogeneous data is achieved through knowledge graphs, and spatiotemporal consistency synchronization is accomplished by relying on event windows, accurately constructing and dynamically updating the enterprise's digital twin. Each update of the twin generates a timestamped version snapshot and summary, and the summary fingerprint is stored on the blockchain for evidence, forming an interlocking guarantee with the blockchain. This effectively detects unauthorized tampering, establishes an immutable evolutionary audit trajectory, and provides a trusted unified computing foundation for enterprise health assessment and risk prediction.

[0071] As an optional embodiment, the system further includes: a contract management module; The contract management module is used to receive service adjustment instructions from the object to be evaluated, and to determine the target service and authorized changes based on the service adjustment instructions; The contract management module is also used to determine the data element subset and evaluation operator list corresponding to the target service, and to generate a contract revision draft based on the authorized changes. The data element subset and evaluation operator list are used to determine the evaluation operator package. The contract management module is also used to activate or block the data link corresponding to the draft contract revision when the object to be evaluated completes digital signing of the draft contract revision. The contract management module is also used to block the data access path and operator execution permissions of the target service if the object to be evaluated refuses to sign the draft contract revision. The evidence storage module is used to store the draft amendments to the contract.

[0072] Specifically, the contract management module includes, for example: Figure 2 The module is a subscription-driven, interactive, dynamic contract governance module. The core issue addressed by the contract management module is the dynamic alignment between data authorization and business evolution.

[0073] In terms of automated contract derivation, when the entity to be evaluated subscribes to new evaluation services through the platform, such as upgrading from basic financial health assessment to supply chain risk stress simulation or canceling existing services, the platform will generate service adjustment instructions and send the service adjustment instructions to the contract management module.

[0074] The contract management module receives service adjustment instructions from the object to be evaluated and determines the target service and authorized changes based on these instructions. For example, the contract management module automatically executes contract derivation logic, performs a differential comparison between the parsed results and the authorized scope in the currently effective contract, and identifies newly added data fields, newly added operator types, and authorized items that need to be revoked.

[0075] The contract management module is also used to determine the subset of data elements and the list of evaluation operators corresponding to the target service. For example, based on the functional definition of the new service, it reverse-engineers the required subset of data elements and the corresponding list of processing operators. The subset of data elements and the list of evaluation operators are used to determine the evaluation operator package.

[0076] Finally, the contract management module generates a draft contract revision based on the authorized changes. This draft contract revision is presented in a dual format of readable natural language and machine-executable structured rules, and includes a diagram illustrating the changes in data flow involved in this revision.

[0077] Regarding user review and signing, the draft contract revision is pushed to the review interface of the enterprise's authorized administrator through a secure channel. The review interface presents a comparison of the changes between the old and new contracts in a differential highlighting mode, clearly marking the service functions and data fields corresponding to each newly authorized item. Before the user completes the digital signature, all new data links involved in this revision are in a mandatory locked state, and the system technically prevents any unauthorized data access attempts.

[0078] When the entity to be evaluated completes a digital signature on a draft contract revision, the contract management module activates or blocks the data link corresponding to the draft contract revision. For example, if the enterprise subsequently subscribes to a new service or cancels an existing service, the contract governance module automatically derives a draft contract revision, which is then activated or blocked after being reviewed and signed by the enterprise.

[0079] If the entity being evaluated refuses to sign the draft contract revision, the contract management module automatically executes version isolation logic: permanently blocking the data access path and operator execution permissions corresponding to the target service (unless the user re-initiates the signing process in the future), while all existing services under the original contract framework continue to operate normally without any impact. This isolation logic is implemented by maintaining an independent version context environment in the contract execution engine, ensuring that there is no cross-interference between contract rules of different versions.

[0080] The contract revision draft is stored using the evidence storage module, and every signing, revision, and version isolation operation of the contract is submitted to the blockchain audit module for on-chain evidence storage in real time.

[0081] In this embodiment, the contract management module enables automatic contract derivation, differential review, and digital signing for service adjustments. After signing, the corresponding data link is activated / blocked, and if rejected, version isolation is performed to ensure the normal operation of the original service. The entire contract process is recorded on the blockchain in real time, realizing dynamic synchronization between data authorization and business evolution. This completely eliminates governance blind spots of over-authorization and under-authorization, allowing data authorization to accurately adapt to business changes and improving the flexibility and security of authorization governance.

[0082] As an optional embodiment, the system further includes: an instruction processing module for the object to be evaluated; The object to be evaluated instruction processing module is used to receive operation instructions sent by the object to be evaluated, obtain the administrator identity authentication information of the object to be evaluated, and execute the operation instructions if the administrator identity authentication information is verified. The object to be evaluated instruction processing module is also used to determine the data to be erased corresponding to the physical deletion instruction and erase the data to be erased when the operation instruction is a physical deletion instruction.

[0083] Specifically, the instruction processing module for the object to be evaluated is, for example: Figure 2 The engine for verifying the exercise and destruction of sovereignty within the system. The instruction processing module for the object to be evaluated provides enterprises with complete sovereign control over their derived data elements and digital twins in the cloud.

[0084] In terms of sovereign operations, the instruction processing module for the object under evaluation provides a unified sovereign operation interface (with both application programming interface and visual operation console running in parallel) to the object under evaluation. The object under evaluation can initiate data deletion, migration, or service termination instructions at any time through the sovereign operation interface. Examples of operation instructions include: physical deletion instructions, requiring the central side to permanently erase specified data elements or twin snapshots; logical migration instructions, requiring the migration of specified data to a third-party storage location designated by the enterprise; and service change or termination instructions, requiring the suspension or termination of the data processing chain for a specific evaluation service.

[0085] All operation instructions must be confirmed by the enterprise's authorized administrator through multi-factor authentication before they can be executed. For example, the instruction processing module for the object to be evaluated obtains the administrator's authentication information for the object to be evaluated, and executes the operation instructions if the administrator's authentication information is verified.

[0086] When the operation instruction is a physical deletion instruction, the instruction processing module of the object to be evaluated determines the data to be erased corresponding to the physical deletion instruction and erases the data to be erased.

[0087] In addition, after the instruction processing module of the object to be evaluated performs physical deletion, an independently verifiable destruction certificate can be generated according to the four-stage time sequence process of physical erasure → zero-knowledge proof generation → on-chain evidence storage → enterprise verification.

[0088] In this embodiment, a sovereign operation interface is provided through the instruction processing module of the object to be evaluated. After multi-factor authentication and verification, operations such as deletion and migration are performed to ensure the enterprise's complete sovereign control over cloud data and digital twins. After physical deletion, a destruction certificate is generated according to a four-stage process. Relying on zero-knowledge proofs and blockchain notarization, on-chain proof and off-chain physical deletion are realized. Hardware signatures ensure the authenticity of erased metadata and prevent forgery, providing cryptographically verifiable protection for data sovereignty.

[0089] As an optional embodiment, the instruction processing module for the object to be evaluated includes: a physical erasure unit, a destruction certificate generation unit, a certificate storage unit, and a data transmission unit; The physical erasure unit is used to perform erasure operations on the data to be erased, determine the metadata corresponding to the erasure operation, and digitally sign the metadata. The destruction credential generation unit is used to generate encrypted destruction credentials based on the metadata of the completed digital signature, preset statement information, and preset proof protocol. The evidence storage unit is used to generate a cryptographic fingerprint of the encrypted destruction certificate, obtain the operation timestamp and operation initiator identifier of the erasure operation, and transmit the cryptographic fingerprint, operation timestamp and operation initiator identifier to the evidence storage module so that the evidence storage module can store the cryptographic fingerprint, operation timestamp and operation initiator identifier. The data sending unit is used to send the encrypted destruction certificate, preset statement information and preset key to the object to be evaluated, so that the object to be evaluated can determine whether the data to be erased has been physically erased.

[0090] Specifically, the physical erasure unit performs physical erasure operations on the data to be erased, determining the corresponding metadata. For example, if the physical erasure unit is a central storage management component, the central storage management component performs multiple rounds of overwrite and erase operations on the target physical storage block (such as erasure methods compliant with relevant security standards), and records metadata such as the physical address range, overwrite rounds, overwrite mode, and completion timestamp of the erase operation. The physical erasure unit digitally signs the metadata to ensure its authenticity and immutability, which is a prerequisite for the validity of subsequent zero-knowledge proofs.

[0091] The destruction credential generation unit is used to generate encrypted destruction credentials as zero-knowledge proofs.

[0092] Pre-defined statements include, for example, the statement that the data content corresponding to the specified data identifier in the proposition to be proved has undergone a specified number of irreversible overwrites and erasures within a specified physical address range. A pre-defined proof protocol is also included, for example, running a zero-knowledge proof protocol.

[0093] The destruction credential generation unit generates an encrypted destruction credential based on the metadata of the completed digital signature, the preset statement information, and the preset proof protocol. For example, it uses the metadata of the completed digital signature as the secret input, combines it with the preset statement information, runs the preset proof protocol, selects a concise non-interactive zero-knowledge proof scheme, and generates a concise encrypted destruction credential.

[0094] The key feature of this encrypted destruction credential is that the verifier can verify the correctness of the credential in polynomial time, without knowing the physical address layout, storage architecture, or any other sensitive infrastructure information of the cloud storage, relying solely on the publicly available verification key and public statements.

[0095] The evidence storage unit generates a cryptographic fingerprint of the encrypted destruction certificate, obtains the timestamp of the erasure operation and the identifier of the initiator, and transmits the cryptographic fingerprint, timestamp, and initiator identifier to the evidence storage module. The evidence storage module then submits the cryptographic fingerprint, timestamp, and initiator identifier as a transaction to the blockchain audit module, writing it into the next block of the permissioned blockchain. This step achieves a cross-level mapping from the physical erasure fact to on-chain immutable evidence, a capability not possessed by existing blockchain evidence storage systems (which typically only store hashes of data generation or circulation).

[0096] The data sending unit is used to meet the independent verification needs of enterprises. After on-chain notarization is completed, the data sending unit sends the encrypted destruction certificate, preset statement information, and preset key to the object to be evaluated, so that the object to be evaluated can determine whether the data to be erased has been physically erased. The object to be evaluated or its commissioned third-party auditing institution runs a zero-knowledge proof verification algorithm. If the output is successful, it can be confirmed that the corresponding data has been physically erased in the cloud, and no knowledge of any internal architecture details of the cloud is required throughout the process.

[0097] In this embodiment, physical erasure of data is performed, and trusted hardware signs the erased metadata. An encrypted destruction credential is generated based on zero-knowledge proofs, and the credential fingerprint and other information are stored on the blockchain as evidence. This achieves a cross-level trusted mapping from off-chain physical erasure to on-chain cryptographic evidence. Enterprises can independently verify the deletion results without needing to know the cloud architecture. Hardware signatures prevent forgery from the source, effectively solving the technical challenge of on-chain proof of off-chain physical deletion.

[0098] As an optional embodiment, the system further includes: a function expansion module; The functional extension module is used to determine whether a risk signal has been detected based on the digital twin of the object to be evaluated; The functional extension module is also used to generate a disturbance factor based on the risk signal when a risk signal is detected, and to determine the downstream objects of the object to be evaluated. The functional extension module is also used to inject disturbance factors into the digital twin of downstream objects to obtain target digital twins, perform asymmetric stress test simulations based on target digital twins, obtain simulation results, and generate early warning reports based on simulation results. The early warning reports are used to determine the magnitude of the impact of the object to be evaluated on downstream objects.

[0099] Specifically, functional extension modules include, for example: Figure 2The privacy collaboration and ecosystem expansion module is designed for cross-organizational collaboration scenarios. Without compromising the data sovereignty boundaries of individual enterprises, it enables external system linkage for industry benchmarking, supply chain risk transmission, and assessment results.

[0100] Let's take an example where the entity to be evaluated is an upstream company and the downstream entity is a downstream company. Regarding the transmission of hidden risks in the supply chain, the extended functionality module uses the digital twin of the entity to be evaluated to determine whether risk signals have been detected (such as a sudden drop in the financial indicators of key suppliers, production line shutdowns, etc.).

[0101] When the digital twin of an upstream enterprise detects a risk signal, the functional extension module does not directly disclose the original risk data from the upstream to downstream enterprises. Instead, it transforms the risk signal into an encrypted perturbation factor through a differential privacy mechanism. It then identifies the downstream entities of the entity to be evaluated, such as downstream companies of the upstream enterprise.

[0102] The functional extension module injects a perturbation factor into the digital twin of the downstream object to obtain the target digital twin. Based on the target digital twin, an asymmetric stress test simulation is performed to assess the potential impact of upstream enterprise supply chain risks on the health indicators of downstream enterprises. Simulation results are obtained, and an early warning report is generated based on these results. The early warning report determines the extent of the impact of the assessed object on downstream objects.

[0103] In addition, the functional extension module can achieve the following functions in industry benchmarking of federated learning: Deploying a horizontal federated learning framework: Each enterprise's edge-side trusted execution environment performs model training on anonymized data elements locally, uploading only the encrypted model parameter gradients (rather than the original elements or intermediate features) to the central-side secure aggregation server. The aggregation server uses a secure aggregation protocol based on secret sharing to encrypt and aggregate the gradients from all parties, updates the global model parameters, and then distributes them to each edge side. Through multiple iterations, an industry-level health assessment benchmark model is trained without exchanging any enterprise private data elements, thereby supporting cross-enterprise anonymized industry ranking and benchmarking analysis.

[0104] In terms of external system linkage for assessment results, the functional extension module can achieve the following functions: It provides a standardized interface for outputting assessment results, transforming the multi-dimensional assessment indicators output by the digital twin into risk quantification assessment parameters after standardization. These parameters can be used as input data to trigger automated resource allocation logic pre-deployed on a permissioned blockchain via a blockchain smart contract interface. The resource allocation logic automatically calculates and outputs the corresponding risk level assessment value or compliance incentive control coefficient according to preset parameter mapping rules, and pushes the calculation results to the associated external systems in a verifiable manner. Updates to the assessment indicators will automatically trigger the re-execution of the smart contract, achieving dynamic linkage between assessment results and external resource allocation decisions.

[0105] In this embodiment, risk signals from upstream enterprises are detected by digital twins. Differential privacy is used to convert risks into encrypted perturbation factors without disclosing the original data. The perturbation factors are injected into the downstream twin to conduct stress tests and generate early warning reports. Under the premise of strictly adhering to data sovereignty boundaries, the impact of supply chain risk transmission is accurately assessed, and risk early warning for cross-organizational privacy and security is achieved.

[0106] As an optional embodiment, the evidence storage module includes: an evidence storage record generation unit and an evidence storage unit; The evidence storage record generation unit is used to generate evidence storage records based on the operation type corresponding to the operation instruction, the operation initiator identifier, the operation object identifier, the operation timestamp, and the cryptographic digest of the operation result. The evidence storage unit is used to write evidence storage records into the blockchain in the form of transactions. The blockchain contains multiple on-chain nodes corresponding to multiple users.

[0107] Specifically, the evidence storage module is the infrastructure that links the key operational events of each component of the system into a complete and trustworthy audit chain, and is responsible for the immutable on-chain evidence storage of key operational events during the system operation process.

[0108] The evidence storage module covers the following event types: contract signing, revision and version change records; verification results (including pass and fail) and timestamps of operator remote proofs; sovereign operation instructions (deletion, migration, and modification) initiated by enterprises and their execution status; zero-knowledge proof fingerprints of data destruction certificates; summary fingerprints of digital twin version updates; and participant signatures and model summaries of federated learning aggregation rounds.

[0109] Furthermore, the evidence storage module and other components have the following key data flow coupling relationships: After completing remote proof, the hardware-controlled service push module writes the proof result to this module in real time, extending operator credibility from in-process verification to post-event traceability; after each update of the digital twin, the multi-dimensional management engine writes a version summary to this module, ensuring the immutability of the twin's evolution history; after generating a zero-knowledge proof destruction certificate, the sovereignty exercise and destruction verification engine writes the certificate fingerprint to this module, achieving on-chain proof and off-chain physical deletion capabilities that are impossible with existing technologies. These three coupling relationships constitute the core synergistic effect that distinguishes this embodiment from a simple superposition of trusted execution environment privacy computing and blockchain evidence storage.

[0110] The evidence storage record generation unit generates evidence storage records based on the operation type corresponding to the operation instruction, the operation initiator identifier, the operation object identifier, the operation timestamp, and the cryptographic digest of the operation result. Each evidence storage record contains the operation type, operation initiator identifier, operation object identifier, operation timestamp, and the cryptographic digest of the operation result.

[0111] The evidence storage unit adopts a permissioned blockchain architecture, utilizing blockchain for immutable evidence storage. The blockchain contains multiple on-chain nodes corresponding to multiple users; for example, the on-chain nodes consist of nodes representing the system operator, participating enterprise representatives, and optional independent auditing institutions.

[0112] The evidence storage unit is used to write evidence storage records into the blockchain in the form of transactions. Each evidence storage record is written into the blockchain in the form of a transaction. The blockchain only stores summary and fingerprint information, and does not store any original data or element content, thereby ensuring the integrity of the audit while avoiding the risk of on-chain data leakage.

[0113] In this embodiment of the application, blockchain full lifecycle evidence storage covers all key links such as contract governance, operator verification, sovereign operation, destruction of credentials, and twin update, transforming the black-box mode of traditional data processing into a white-box mode that enterprises can audit and intervene at any time.

[0114] According to an embodiment of the present invention, a method for determining the health status of an object to be evaluated is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0115] This embodiment provides a method for determining the health status of an object to be evaluated, which can be used in the aforementioned system for determining the health status of an object to be evaluated. Figure 3 This is a flowchart of a method for determining the health status of an object to be evaluated according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps: Step S301: Determine the evaluation operator package corresponding to the object to be evaluated, and send the evaluation operator package to the edge computing node of the object to be evaluated.

[0116] Specifically, the data push module determines the evaluation operator package corresponding to the object to be evaluated. For example, based on the data subset and processing scope defined by the currently effective data usage contract, it selects the corresponding evaluation operator package from the operator repository on the central side. The evaluation operator package is then sent to the edge computing node of the object to be evaluated through an encrypted transmission channel. The edge computing node of the object to be evaluated is, for example, an edge computing node deployed locally by the enterprise.

[0117] Step S302: Obtain the proof report sent by the edge computing node, determine the runtime fingerprint of the evaluation operator package based on the proof report, compare the runtime fingerprint with the initial fingerprint, and generate a verification result based on the comparison result. The proof report is generated by the edge computing node based on the evaluation operator package and the identification information.

[0118] Specifically, before the operator is loaded into the hardware isolation zone, the edge computing node system executes a remote proof process. For example, the trusted execution environment hardware in the edge computing node generates a proof report containing the isolation zone code metric and the signer identity metric. This proof report is signed by the hardware's built-in proof key and sent to the proof service module for verification.

[0119] The proof service module can provide independent remote proof services. It obtains proof reports sent by edge computing nodes, determines the runtime fingerprint of the evaluation operator package based on the proof reports, compares the runtime fingerprint with the initial fingerprint, and generates a verification result based on the comparison result.

[0120] Step S303: Obtain the data elements sent by the evaluation operator package in the edge computing node, update the digital twin according to the data elements, and obtain the updated digital twin and the update summary. The data elements are generated by the evaluation operator package based on the original operation data in the hardware isolation area of ​​the edge computing node when the verification result is successful.

[0121] Specifically, the data management module acquires data elements sent by the evaluation operator packets in the edge computing nodes. These data elements are then written into the digital twin to update it, resulting in an updated digital twin and an update summary. The update summary is then transmitted to the evidence storage module for on-chain evidence storage, thereby establishing an immutable audit trail of the digital twin's evolution history.

[0122] Step S304: Generate a health assessment report for the subject to be assessed based on the updated digital twin.

[0123] Specifically, the health assessment module generates a health assessment report for the subject based on the updated digital twin. For example, the health assessment module performs health assessment calculations based on the updated digital twin, outputs a comprehensive score and sub-scores for each dimension, and generates a visual health assessment report.

[0124] Step S305: Store the verification results and the updated summary as evidence.

[0125] Specifically, the evidence storage module is the infrastructure that links the key operational events of various system components into a complete and trustworthy audit chain. It is responsible for the immutable on-chain evidence storage of key operational events during system operation. The evidence storage module is used to store verification results and update summaries.

[0126] The method for determining the health status of an object to be evaluated provided in this embodiment, in terms of data security, achieves this by using trusted execution environment hardware isolation and remote verification mechanisms. This ensures that the original operational data of the object to be evaluated does not leave the domain at the physical level, and the security and trustworthiness of external operators can be independently verified by the enterprise. The remote verification results are written to the blockchain in real time, giving the verification records immutable and permanent traceability. This solves the problem that when quantitatively assessing the comprehensive health status of an enterprise, it is difficult to verify the computational logic running in the enterprise's local environment and to store the verification results, thus making it difficult to guarantee the enterprise's data security.

[0127] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0128] The following is a detailed reference. Figure 4 This diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 401, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 402 or a program loaded from memory 408 into random access memory (RAM) 403. The RAM 403 also stores various programs and data required for the operation of the electronic device. The processor 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0129] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0130] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 409, or installed from a memory 408, or installed from a ROM 402. When the computer program is executed by the processor 401, it performs the functions defined above in the method for determining the health status of the object to be evaluated according to embodiments of the present invention.

[0131] Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0132] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium after being downloaded via a network. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the health status determination method for the object to be evaluated shown in the above embodiments is implemented.

[0133] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0134] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A system for determining the health status of an object to be evaluated, characterized in that, The system includes: a data push module, a proof service module, a data management module, a health assessment module, and a proof storage module; The data push module is used to determine the evaluation operator package corresponding to the object to be evaluated, and to send the evaluation operator package to the edge computing node of the object to be evaluated; The proof service module is used to obtain the proof report sent by the edge computing node, determine the runtime fingerprint of the evaluation operator package based on the proof report, compare the runtime fingerprint with the initial fingerprint, generate a verification result based on the comparison result, and transmit the verification result to the proof storage module. The proof report is generated by the edge computing node based on the evaluation operator package and the identification information. The data management module is used to acquire data elements sent by the evaluation operator package in the edge computing node, update the digital twin according to the data elements, obtain the updated digital twin and the update summary, and transmit the update summary to the evidence storage module. The data elements are generated by the evaluation operator package based on the original operation data in the hardware isolation area of ​​the edge computing node when the verification result is successful. The health assessment module is used to generate a health assessment report for the object to be assessed based on the updated digital twin. The evidence storage module is used to store the verification result and the update summary as evidence.

2. The system according to claim 1, characterized in that, The proof service module includes: a verification result generation unit and an exception handling unit; The verification result generation unit is used to compare the runtime fingerprint with the initial fingerprint to obtain a comparison result, obtain a verification timestamp, and generate the verification result based on the verification timestamp, the runtime fingerprint, the initial fingerprint, and the comparison result. The exception handling unit is used to send an operator stop running instruction to the edge computing node when the runtime fingerprint is different from the initial fingerprint, and to generate a verification failure event based on the verification timestamp, the runtime fingerprint and the comparison result. The operator stop running instruction is used to instruct the edge computing node to stop loading and executing the evaluation operator package. The evidence storage module is used to store evidence of the verification failure event.

3. The system according to claim 1, characterized in that, The data management module includes: a first data processing unit, a second data processing unit, and a digital twin management unit; The first data processing unit is used to generate a knowledge graph ontology based on a preset indicator system, and adjust the data elements based on the knowledge graph ontology to obtain first intermediate data; The second data processing unit is used to adjust the update frequency of the first intermediate data according to a preset event window to obtain the second intermediate data; The digital twin management unit is used to inject the second intermediate data into the digital twin to obtain the version snapshot and the update summary corresponding to the digital twin, and to obtain the updated digital twin based on the version snapshot.

4. The system according to claim 1, characterized in that, The system also includes: a contract management module; The contract management module is used to receive the service adjustment instruction of the object to be evaluated, and determine the target service and authorization changes based on the service adjustment instruction; The contract management module is further configured to determine the data element subset and evaluation operator list corresponding to the target service, and generate a contract revision draft based on the authorized changes, wherein the data element subset and the evaluation operator list are used to determine the evaluation operator package; The contract management module is also used to activate or block the data link corresponding to the draft contract revision when the object to be evaluated completes digital signing of the draft contract revision. The contract management module is also used to block the data access path and operator execution permission of the target service if the object to be evaluated refuses to sign the draft contract revision. The evidence storage module is used to store the draft contract revision.

5. The system according to claim 1, characterized in that, The system also includes: an instruction processing module for the object to be evaluated; The object to be evaluated instruction processing module is used to receive the operation instruction sent by the object to be evaluated, obtain the administrator identity authentication information of the object to be evaluated, and execute the operation instruction if the administrator identity authentication information is verified. The object to be evaluated instruction processing module is further configured to determine the data to be erased corresponding to the physical deletion instruction and erase the data to be erased when the operation instruction is a physical deletion instruction.

6. The system according to claim 5, characterized in that, The instruction processing module for the object to be evaluated includes: a physical erasure unit, a destruction certificate generation unit, a certificate storage unit, and a data sending unit; The physical erasure unit is used to perform an erasure operation on the data to be erased, determine the metadata corresponding to the erasure operation, and digitally sign the metadata. The destruction credential generation unit is used to generate an encrypted destruction credential based on the metadata of the completed digital signature, preset statement information, and preset proof protocol. The evidence storage unit is used to generate the cryptographic fingerprint of the encrypted destruction certificate, obtain the operation timestamp and operation initiator identifier of the erasure operation, and transmit the cryptographic fingerprint, the operation timestamp and the operation initiator identifier to the evidence storage module so that the evidence storage module can store the cryptographic fingerprint, the operation timestamp and the operation initiator identifier. The data sending unit is used to send the encrypted destruction certificate, the preset statement information, and the preset key to the object to be evaluated, so that the object to be evaluated can determine whether the data to be erased has been physically erased.

7. The system according to claim 1, characterized in that, The system also includes: a function expansion module; The functional extension module is used to determine whether a risk signal has been detected based on the digital twin of the object to be evaluated. The functional extension module is also used to generate a disturbance factor based on the risk signal when the risk signal is detected, and to determine the downstream object of the object to be evaluated; The functional extension module is further configured to inject the disturbance factor into the digital twin of the downstream object to obtain a target digital twin, perform an asymmetric stress test simulation based on the target digital twin to obtain simulation results, and generate an early warning report based on the simulation results, wherein the early warning report is used to determine the magnitude of the impact of the object to be evaluated on the downstream object.

8. The system according to claim 5, characterized in that, The evidence storage module includes: an evidence storage record generation unit and an evidence storage unit; The evidence storage record generation unit is used to generate evidence storage records based on the operation type, operation initiator identifier, operation object identifier, operation timestamp, and cryptographic digest of the operation result corresponding to the operation instruction. The evidence storage unit is used to write the evidence storage record into the blockchain in the form of a transaction, wherein the blockchain contains multiple on-chain nodes corresponding to users.

9. A method for determining the health status of an object to be evaluated, characterized in that, The method includes: Determine the evaluation operator package corresponding to the object to be evaluated, and send the evaluation operator package to the edge computing node of the object to be evaluated; Obtain the proof report sent by the edge computing node, determine the runtime fingerprint of the evaluation operator package based on the proof report, compare the runtime fingerprint with the initial fingerprint, and generate a verification result based on the comparison result. The proof report is generated by the edge computing node based on the evaluation operator package and the identification information. The data elements sent by the evaluation operator package in the edge computing node are obtained, and the digital twin is updated according to the data elements to obtain the updated digital twin and the update summary. The data elements are generated by the evaluation operator package based on the original operation data in the hardware isolation area of ​​the edge computing node when the verification result is successful. Based on the updated digital twin, a health assessment report for the subject to be assessed is generated; The verification results and the update summary are stored as evidence.

10. An electronic device, characterized in that, include: The system includes a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the health status determination method for the object to be evaluated as described in claim 9.

Images