Blockchain-based data management method, apparatus, and system and electronic device

Abstract

Disclosed in the present disclosure are a blockchain-based data management method, apparatus, and system and an electronic device. The data management method comprises: on the basis of a plurality of metadata types, generating a plurality of corresponding sub-directories, wherein the plurality of metadata types include an unstructured data type, a semi-structured data type, and a structured data type; on the basis of the metadata types of data, determining data identifiers and storage locations of the data, wherein the storage locations of the unstructured data type, the semi-structured data type, and the structured data type are different; and at least on the basis of the plurality of subdirectories and the data identifiers, storing and managing the data.

Description

Blockchain-based data management method, device, system, and electronic device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on the Chinese patent application with application number 202311021740.9 and application date August 14, 2023, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby introduced into this application in its entirety. Technical Field

[0003] The present disclosure relates to the field of blockchain application technology, and in particular to a blockchain-based data management method, device, system, and electronic device. Background Art

[0004] Blockchain technology is a distributed infrastructure and computing paradigm that uses a block-chain data structure to verify and store data, a distributed consensus algorithm to generate and update data, cryptography to ensure secure data transmission and access, and smart contracts composed of automated script code to program and manipulate data. Blockchain sidechain technology facilitates data transfer between different blockchains, connecting them through trusted data pathways to enable interoperability between blockchain ledgers, enabling blockchain expansion and data exchange.

[0005] Existing blockchain technologies generally lack classification management methods based on data types, and lack storage and management methods tailored to the characteristics of different types of data. In addition, existing blockchain technologies lack the ability to form data directories from metadata, as well as efficient permission control and privacy protection solutions for data directory applications, calls, and authorization data.

[0006] Summary of the Invention

[0007] In view of the above problems, the present disclosure is proposed. The present disclosure provides a data management method, device, system and electronic device based on blockchain.

[0008] According to one aspect of the present disclosure, a blockchain-based data management method is provided, comprising: generating a corresponding plurality of sub-directories based on a plurality of metadata types, wherein the plurality of metadata types include an unstructured data type, a semi-structured data type, and a structured data type; determining a data identifier and a storage location of the data based on the metadata type of the data, wherein the storage locations of the unstructured data type, the semi-structured data type, and the structured data type are different; and storing and managing the data based at least on the plurality of sub-directories and the data identifiers.

[0009] In addition, according to an aspect of the present disclosure, a blockchain-based data management method determines the data identifier and storage location of the data based on the metadata type of the data, including: if the metadata type of the data is an unstructured data type, the data is stored in a distributed storage system, and the hash value of the storage address of the data in the distributed storage system is stored in the blockchain where the first user terminal to which the data belongs is located, and the hash value of the storage address in the block information of the blockchain is determined as the data identifier of the data; if the metadata type of the data is a semi-structured data type, the data is stored in the first user terminal, and the hash value of the data is stored in the blockchain where the first user terminal is located, and the hash value of the data in the block information of the blockchain is determined as the data identifier of the data; if the metadata type of the data is a structured data type, the data is stored in the blockchain to which the first user terminal belongs, and the block information of the data in the blockchain is determined as the data identifier of the data.

[0010] In addition, the blockchain-based data management method according to one aspect of the present disclosure also includes: determining standardized information of the data, wherein the standardized information includes data summary information, authority information, key information and data identification of the data; and generating a blockchain token of the data based on the standardized information, wherein the corresponding blockchain tokens of the unstructured data type data, semi-structured data type data and structured data type data of the first user terminal constitute the blockchain token sequence of the first user terminal.

[0011] In addition, the blockchain-based data management method according to one aspect of the present disclosure also includes: generating data directory information based on the unstructured data type data, semi-structured data type data and structured data type data of the first user terminal, and corresponding standardized information; and storing the data directory information in the directory chain where the first user terminal is located.

[0012] In addition, the blockchain-based data management method according to one aspect of the present disclosure further includes: in response to a second user terminal's authorization request for the data to be accessed, configuring data operation permissions for the second user terminal, and determining a corresponding authorized blockchain token, wherein the authorized blockchain token is used for the second user terminal to operate within the data operation permissions and access the data to be accessed.

[0013] In addition, according to an aspect of the present disclosure, a blockchain-based data management method determines a corresponding blockchain token, including: calling a blockchain token corresponding to the data to be accessed as an authorized blockchain token from a blockchain token sequence; or calling private data for the data to be accessed, and generating an authorized blockchain token based on the private data.

[0014] In addition, according to the blockchain-based data management method of one aspect of the present disclosure, the blockchain token corresponds to a first public key managed by a first user terminal and a second public key managed by a third user terminal. The data management method also includes: in response to the second user terminal's authorization request for the data to be accessed, providing the first public key to the second user terminal, wherein the first public key is used for the second user terminal to operate the blockchain token within a predetermined data operation authority, and the second public key is used for the second user terminal to access the data to be accessed within the predetermined data operation authority.

[0015] According to another aspect of the present disclosure, a blockchain-based data management method is provided, including: generating a data directory chain based on data of multiple metadata types belonging to a user terminal, wherein the multiple metadata types include unstructured data types, semi-structured data types, and structured data types, and the data directory chain includes sub-directories corresponding to the multiple metadata types; and storing data identifiers of the data based on the multiple metadata types.

[0016] According to another aspect of the present disclosure, a blockchain-based data management device is provided, including: a sub-directory management unit, configured to generate a corresponding plurality of sub-directories based on multiple metadata types, wherein the multiple metadata types include unstructured data types, semi-structured data types, and structured data types; a data management unit, configured to determine a data identifier and a storage location of the data based on the metadata type of the data; and store and manage data based on at least the multiple sub-directories and the data identifiers, wherein the storage locations of the unstructured data type, the semi-structured data type, and the structured data type are different.

[0017] According to another aspect of the present disclosure, a blockchain-based data management device is provided, including: a data directory chain management unit, configured to generate a data directory chain based on data of multiple metadata types belonging to a user terminal, wherein the multiple metadata types include unstructured data types, semi-structured data types, and structured data types, and the data directory chain includes sub-directories corresponding to the multiple metadata types; and a data identification management unit, configured to store data identifications of data based on the multiple metadata types.

[0018] According to another aspect of the present disclosure, a blockchain-based data management system is provided, including: a data management user device, which is used to generate a corresponding plurality of sub-directories based on a plurality of metadata types, determine a data identifier and a storage location of the data based on the metadata type of the data, and store and manage the data based at least on the plurality of sub-directories and the data identifiers; a data management side-chain device, which is used to store and manage directory chain information of the plurality of sub-directories generated by the data management user device and the data identifier of the data; and a data management system device, which is used to provide communication control of one or more data management user devices and one or more data management side-chain devices, and store and manage directory chain information of the one or more data management side-chain devices.

[0019] According to another aspect of the present disclosure, an electronic device is provided, including: a memory for storing computer-readable instructions; and a processor for executing the computer-readable instructions so that the electronic device performs the blockchain-based data management method as described above.

[0020] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium is provided for storing computer-readable instructions. When the computer-readable instructions are executed by a processor, the processor executes the blockchain-based data management method as described above.

[0021] As will be described in detail below, according to the blockchain-based data management method, device, system and electronic device of the embodiments of the present disclosure, by generating corresponding data sub-directories based on metadata types and implementing different data identification and storage location management based on metadata types, unified data management based on the directory chain is achieved, thereby realizing efficient permission control and privacy protection for data application, call and authorization.

[0022] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and other purposes, features, and advantages of the present disclosure will become more apparent through a more detailed description of the embodiments of the present disclosure in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and are not intended to limit the present disclosure. In the drawings, the same reference numerals generally represent the same components or steps.

[0024] FIG1 is a schematic diagram illustrating a blockchain system for data management according to an embodiment of the present disclosure.

[0025] FIG2 is a flowchart illustrating a blockchain-based data management method according to an embodiment of the present disclosure.

[0026] FIG3 is a schematic diagram illustrating a data directory according to an embodiment of the present disclosure.

[0027] FIG4 is a flowchart further illustrating a blockchain-based data management method according to an embodiment of the present disclosure.

[0028] FIG5 is a flowchart further illustrating a blockchain-based data management method according to an embodiment of the present disclosure.

[0029] FIG6 is a schematic diagram illustrating a data directory chain and a blockchain token sequence according to an embodiment of the present disclosure.

[0030] FIG7 is a schematic diagram illustrating a data information structure and a token certificate structure according to an embodiment of the present disclosure.

[0031] FIG8 is a functional block diagram illustrating a blockchain-based data management device according to an embodiment of the present disclosure.

[0032] FIG9 is a functional block diagram illustrating another data management device based on blockchain according to an embodiment of the present disclosure.

[0033] FIG10 is a functional block diagram illustrating a blockchain-based data management system according to an embodiment of the present disclosure.

[0034] FIG11 is a flowchart further illustrating a blockchain-based data management method according to an embodiment of the present disclosure.

[0035] FIG12 is a flowchart further illustrating a blockchain-based data management method according to an embodiment of the present disclosure.

[0036] FIG13 is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0037] FIG. 14 is a schematic diagram illustrating a computer-readable storage medium according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present disclosure more apparent, the following will describe in detail exemplary embodiments of the present disclosure with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described herein.

[0039] First, a blockchain system for data management according to an embodiment of the present disclosure is described with reference to FIG1 .

[0040] As shown in FIG1 , the blockchain system for data management according to an embodiment of the present disclosure includes a main chain 10 and side chains 20 and 30. There are multiple user terminals a1-a4 in side chain 20, and multiple user terminals b1-b4 in side chain 30. Multiple user terminals a1-a4 and b1-b4 serve as data management user devices, which will be described in detail below. In addition, there are terminals a0 and b0 in side chains 20 and 30, respectively, which serve as data management side chain devices, which will be described in detail below. Terminal c0 is schematically present in the main chain 10, which serves as a data management system device, which will be described in detail below. It is easy to understand that the structure of the main chain and side chains shown in FIG1 and the types and quantities of various devices therein are schematic and do not limit the present disclosure.

[0041] As will be described in detail below, multiple user terminals a1-a4 and b1-b4 act as data owners, generate corresponding data subdirectories based on metadata types, and implement different data identification and storage location management based on metadata types. They further perform unified cross-chain data management based on the directory chain, thereby achieving efficient permission control and privacy protection for data application, call, and authorization.

[0042] The following further describes a blockchain-based data management method according to an embodiment of the present disclosure. Figure 2 is a flow chart illustrating a blockchain-based data management method according to an embodiment of the present disclosure. Figure 3 is a schematic diagram illustrating a data directory according to an embodiment of the present disclosure. Using the data management method shown in Figure 2, a data directory as shown in Figure 3 can be generated.

[0043] As shown in Figure 2, the blockchain-based data management method according to an embodiment of the present disclosure includes the following steps. It should be understood that the data management method shown in Figure 2 is executed by, for example, one of the multiple user terminals a1-a4 and b1-b4 (i.e., data management user devices) as data owners in Figure 1.

[0044] In step S201 , a plurality of corresponding sub-directories are generated based on a plurality of metadata types.

[0045] In the embodiments of this disclosure, the data managed by the blockchain-based data management method can be non-monetary, non-physical assets owned or controlled by businesses or individuals, existing in the form of electronic data and held for sale. This type of data is also referred to as data assets. Data assets are information, certificates, media data, text, and other data generated through the assetization process.

[0046] In an embodiment of the present disclosure, multiple metadata types include unstructured data types, semi-structured data types, and structured data types. For example, unstructured data types are mainly pictures and videos, semi-structured data types are represented by certificates and rights information, and structured data types can be standardized personal data. The characteristics of different metadata types lead to significant differences in directory management, data generation methods, and flow authorization mechanisms. At the same time, user data is often stored in different data management user devices. Therefore, there is a need for a data management method that can uniformly manage multiple data management user devices, co-manage with multi-party authorization, and cover differentiated data types.

[0047] 3 , the data management user device has three types of metadata libraries: metadata library type D1 (unstructured database), metadata library type D2 (semi-structured database), and metadata library type D3 (structured database). The three types of metadata libraries correspond to multiple subdirectories: data subdirectory C1 (unstructured data subdirectory), data subdirectory C2 (semi-structured data subdirectory), and data subdirectory C3 (structured data subdirectory).

[0048] In step S202, the data identifier and storage location of the data are determined based on the metadata type of the data.

[0049] In an embodiment of the present disclosure, for unstructured data type data, the data is stored in a distributed storage system, the hash value of the storage address of the data in the distributed storage system is stored in the blockchain (i.e., blockchain side chain) where the user terminal (i.e., data management user device) to which the unstructured data type data belongs is located, and the block information of the hash value of the storage address in the blockchain is used as the data identifier of the unstructured data type data.

[0050] Referring to Figure 3, for example, for unstructured data type data d1 (such as pictures, videos, etc.), a data distributed storage method such as the InterPlanetary File System (IPFS) is called to store the unstructured data type data d1 in the IPFS system on a public management platform (e.g., a public chain). The hash value of the IPFS address where the data is stored is returned from the IPFS system, the address hash value is digitally signed by the user and encrypted and stored in the blockchain side chain where the user database is located, and the relevant block information is returned as the data identifier a'1 of the unstructured data type data d1. The data identifier a'1 can be registered in a predetermined certificate format to form a data electronic certificate, and the data legitimacy can be subsequently verified through the electronic certificate.

[0051] For semi-structured data type data, the data is stored in the user terminal to which the semi-structured data type data belongs, and the hash value of the data is stored in the blockchain to which the user terminal to which the semi-structured data type data belongs is located, and the block information of the hash value of the semi-structured data type data in the blockchain is used as the data identifier of the semi-structured data type data.

[0052] Referring to Figure 3 , for example, for semi-structured data type d2 (such as credential data such as electronic certificates, which consists of two related components: structured credential information and a corresponding unstructured credential certificate), due to the large volume of data, frequent access times, high privacy requirements, and the required verification efficiency, the semi-structured data type is directly stored locally on the user terminal or authorized terminal to which it belongs. Furthermore, a hash operation is performed on d2, the hash value is digitally signed by the user, encrypted, and stored in the blockchain sidechain where the user database resides. The relevant block information is returned as the data identifier a'2 for the semi-structured data type d2. The user can subsequently verify the authenticity of the corresponding electronic certificate and data by hashing the local file.

[0053] For structured data type data, the data is stored in the blockchain where the first user terminal to which the structured data type data belongs is located, and the block information of the structured data type data in the blockchain is used as the data identifier of the structured data type data.

[0054] Referring to Figure 3, for example, for structured data type data d3 (such as text information and fixed-structure user data), information is extracted directly according to the text structure definition of the data to form a standard data format; after being digitally signed and encrypted by the user, it is stored in the blockchain side chain where the user database is located, and the returned block information is the data identifier a'3 of the structured data type data d3.

[0055] In step S203, data is stored and managed based on at least a plurality of sub-directories and data identifiers.

[0056] Referring to Figure 3 , for example, data identifiers a'1, a'2, and a'3 are registered in corresponding data subdirectories C1, C2, and C3 according to a predetermined information structure. Data directory C is the data subdirectory set {C1, C2, C3}, and the data identifiers corresponding to the directories form a data information library A {A1, A2, A3}. Furthermore, each data directory C corresponds to a specific data management user device, and data sub-libraries based on device identifiers (E1, E2, ...En) can be formed for multiple data management user devices. Each data sub-library can be a mixed-type database structure, that is, it can simultaneously contain three types of secondary data information libraries: A1, A2, and A3. The data information library formed by En is defined by {An1, An2, An3}, and its data directory is {Cn1, Cn2, Cn3}.

[0057] The above describes how the blockchain-based data management method according to an embodiment of the present disclosure generates corresponding subdirectories and data identifiers based on metadata types. The following further describes the process of generating blockchain tokens and directory chains according to the blockchain-based data management method according to an embodiment of the present disclosure.

[0058] FIG4 is a flowchart further illustrating a blockchain-based data management method according to an embodiment of the present disclosure.

[0059] In step S401, the standardized information of the data is determined. In the embodiment of the present disclosure, the standardized information includes data summary information, authority information, key information, data identification, etc.

[0060] Referring to Figure 6, for a piece of data a, standardized information contains all the essential information required for digital management through parsing, and is stored in a standardized text structure. Data a is numbered in the directory using a serial number mechanism, and each data number is mapped to only one piece of standardized information. The three different types of data sub-repositories have distinct data information structures, and the standardized information contained therein is parsed and generated from metadata and data information.

[0061] For unstructured data a1, its standardized information includes data summary, digital identifier a'1, permission parameters and secondary keys. The IPFS address hash value can be parsed from a'1 to obtain the storage address of the data.

[0062] For semi-structured data a2, its standardized information includes data summary, digital identifier a'2, structured information (such as certificate information), permission parameters and secondary keys. The data evidence hash value can be parsed from a'2 to perform data verification or permission operations.

[0063] For structured data a3, its standardized information includes data summary, digital identifier a'3, authority parameters and secondary key, and data text information can be parsed from a'3.

[0064] In step S402, a blockchain token of the data is generated based on the standardized information.

[0065] In the embodiments of the present disclosure, key information is obtained from data standardization information to generate blockchain tokens. A specific data information a can correspond to one or more tokens, and the token sequence is the token identifier {T}. This forms a complete mapping relationship from metadata to data to data identifier to data information to data blockchain tokens.

[0066] FIG7 is a schematic diagram illustrating a data information structure and a token certificate structure according to an embodiment of the present disclosure.

[0067] The token structure shown in Figure 7 is (header field | payload field | signature field).

[0068] (1) The header field is a description of the encryption algorithm for the token information;

[0069] (2) The payload field contains the permission type identifier and authorization condition identifier (such as authorization time limit), as well as a summary of relevant data information;

[0070] (3) The signature field is the encrypted data information content signed by the user.

[0071] In the corresponding data information a, the data summary and the permission parameters are defined as general information, the data identifier determined according to the metadata type is defined as type information, and the secondary key is the key information.

[0072] In the process of generating tokens, the input relationship and method of its structure and data information structure are as follows:

[0073] (1) The header field is the encryption algorithm identifier of the token information;

[0074] (2) The payload field is compiled and inputted from general information, including data number, data summary information, and data authority information;

[0075] (3) The signature field is compiled from the encrypted and user-signed data identifier a'. The encryption algorithm used is consistent with the algorithm identified in the header field. According to the data type, type a1 is generated by a'1 (IPFS address hash value), type a2 is generated by a'2 (data evidence hash value) and structured information, and type a3 is generated by a'3 (data block information).

[0076] In step S403, data directory information is generated based on the unstructured data type, semi-structured data type and structured data type of the user terminal and corresponding standardized information.

[0077] In step S404, the data directory information is stored as a directory chain at the user terminal.

[0078] In the embodiments of the present disclosure, in order to manage, retrieve and locate data, data directory information is established based on the data information. The directory information is directly stored on the connected blockchain side chain to form a user data directory chain, and is published and queried on the public blockchain platform through a cross-chain mechanism.

[0079] When data sub-libraries A1, A2, A3 and data information a are generated, the data numbers and summary information of the data involved are registered according to the standard directory structure, and the data directory is signed and encrypted and stored on the blockchain side chain to form a directory chain.

[0080] When any data or data directory structure is added, deleted, or changed, the data directory information on the directory chain is revised through the data addition, deletion, and modification operations (for example, consensus is reached among the nodes in the side chain), and the operation information is synchronously stored in the side chain in the form of a log with the user's signature.

[0081] The management and access permissions of the directory chain can be configured according to the participating user roles. Permission settings can be set to directories at all levels, including data directory C, subdirectories C1, C2, C3, and data information.

[0082] The directory chain stored in the side chain can synchronize and share information with the directory chain management module of the public blockchain platform through a cross-chain mechanism, and publish, query and apply for permissions for directory information.

[0083] By setting up a directory chain query method, third-party users can apply for access to the data directory on the public platform. After approval, the data directory information within the permission range will be displayed to the user, and the data summary and number in the directory will be obtained. The user can then initiate an application for permission to obtain or operate the data through the number.

[0084] Corresponding to the data management method performed by the user terminal (ie, data management user device) as described above with reference to FIG. 2 and FIG. 4 , FIG. 5 describes a data management method performed by the terminal (ie, data management side chain device).

[0085] In step S501 , a data directory chain is generated based on data of multiple metadata types belonging to a user terminal.

[0086] In step S502, data identifiers of the data are stored based on multiple metadata types.

[0087] That is to say, the blockchain sidechain terminal (i.e., the data management sidechain device) stores the signed and encrypted data directory and data identifier, so as to synchronize and share information with the directory chain management module of the public blockchain platform through the cross-chain mechanism, and publish, query and apply for permissions for directory information.

[0088] Figure 8 is a functional block diagram illustrating a blockchain-based data management device according to an embodiment of the present disclosure. Figure 9 is a functional block diagram illustrating another blockchain-based data management device according to an embodiment of the present disclosure. The blockchain-based data management device shown in Figure 8 corresponds to user terminals a1-a4 and b1-b4 (i.e., data management user devices) in Figure 1, and the blockchain-based data management device shown in Figure 8 corresponds to terminals a0 and b0 (i.e., data management sidechain devices) in Figure 1.

[0089] As shown in Figure 8, the blockchain-based data management device 800 according to an embodiment of the present disclosure includes a sub-directory management unit 801 and a data management unit 802. Those skilled in the art will readily appreciate that these unit modules can be implemented in various ways, either solely by hardware, solely by software, or by a combination thereof, and the present disclosure is not limited to any of them.

[0090] Specifically, the subdirectory management unit 801 is configured to generate multiple corresponding subdirectories based on multiple metadata types. The data management unit 802 is configured to determine the data identifier and storage location of the data based on the metadata type of the data; and to store and manage the data based at least on the multiple subdirectories and data identifiers. The multiple metadata types include unstructured data types, semi-structured data types, and structured data types, and the storage locations of the unstructured data types, semi-structured data types, and structured data types are different.

[0091] As shown in Figure 9, the blockchain-based data management device 900 according to an embodiment of the present disclosure includes a data directory chain management unit 901 and a data identification management unit 902. Those skilled in the art will readily understand that these unit modules can be implemented in various ways by hardware alone, software alone, or a combination thereof, and the present disclosure is not limited to any of them.

[0092] The data directory chain management unit 901 is configured to generate a data directory chain based on data of multiple metadata types belonging to the user terminal. The data identification management unit 902 is configured to store data identifications of the data based on the multiple metadata types. The multiple metadata types include unstructured data types, semi-structured data types, and structured data types. The data directory chain includes subdirectories corresponding to the multiple metadata types.

[0093] FIG10 is a functional block diagram illustrating a blockchain-based data management system according to an embodiment of the present disclosure.

[0094] As shown in Figure 10, the blockchain-based data management system 100 according to an embodiment of the present disclosure includes multiple data management user devices 101, 102, 103, 104 (for example, corresponding to user terminals a1-a4 and b1-b4 shown in Figure 1), multiple data management side chain devices 201, 202, 203 (for example, corresponding to terminals a0 and b0 shown in Figure 1), and a data management system device 301 (for example, corresponding to terminal c0 shown in Figure 1).

[0095] The data management user devices 101, 102, 103, and 104 are used to generate corresponding multiple sub-directories based on multiple metadata types, determine the data identifier and storage location of the data based on the metadata type of the data, and store and manage data based on at least multiple sub-directories and data identifiers.

[0096] The data management side chain devices 201, 202, and 203 are used to store and manage directory chain information of multiple sub-directories and data identifiers of data generated by the data management user device.

[0097] The data management system device 301 is used to provide communication control for one or more data management user devices 101, 102, 103, 104 and one or more data management side chain devices 201, 202, 203, and store and manage directory chain information of one or more data management side chain devices 201, 202, 203.

[0098] The data management user device 101 includes a data basic management module 1011, an identity management and authentication module 1012, a data directory management module 1013, a database management module 1014, a token management module 1015, a key management module 1016, a privacy computing module 1017 and an IPFS management module 1018.

[0099] More specifically, the data infrastructure management module 1011 is used to configure standardized interfaces for data reception, transmission, and storage, and to communicate with other devices through network protocols, thereby realizing data reception, transmission, and local storage, and ensuring the interaction of various business information and the realization of various functions.

[0100] The identity management and authentication module 1012 is used to upload, store, manage, and verify the user's identity information, and supports digital signatures. The user's personal identity authentication information is registered in the identity management and authentication chain module 2011 of the data management side chain device 201 through this module, and the data management side chain device 201 uses cross-chain technology to share identity information with the data management system device 301, thereby realizing user identity authentication that can be called within the side chain platform and the public system.

[0101] The data directory management module 1013 is used to support operations such as the generation, revision, and deletion of user data directories. The data directory communicates with the data directory chain module 2012 in the data management side chain device 201 through this module to realize the on-chain storage and management of the directory, and shares directory information with the data management system device 301 through cross-chain technology via the data management side chain device 201, thereby realizing the information release, query, and authorization application of the public data directory within the entire platform.

[0102] The database management module 1014 is used to manage the data stored locally on the data management user device 101 and accessed through the data management user device 101 and stored in the data management side chain device 201 (data generation, acceptance, storage, deletion, modification, authorization, etc.). This module communicates with the data management side chain device 201 to realize the chaining and management of the database.

[0103] The token management module 1015 is used to communicate with the data token management module 2013 in the data management side chain device 201 to implement operations such as generation, storage, circulation and tracing of data tokens.

[0104] The key management module 1016 is used to support users in localizing the storage of private keys in asymmetric key pairs, as well as the storage of various public keys and certificates related to data, to ensure users' autonomous management of data ownership and permission control. This module is connected to each module in the data management side chain device 201 to realize the safekeeping of private keys for the directory chain, data information chain, and token chain; and is connected to other data management user devices to realize the safekeeping of various public keys and certificates related to the acquired data.

[0105] The privacy computing module 1017 is used to communicate with the privacy computing management module 2016 in the data management side chain device 201, call the privacy computing model in the data management side chain device 201 and output the calculation results formed based on the data information and key data to meet the protection needs of user privacy in data management.

[0106] The IPFS management module 1018 is used to call the IPFS system module 3015 in the data management system device 301 to cooperate with the data management system device 301 to realize the trusted storage of the user's own metadata or data. Users who obtain the IPFS address can obtain metadata assets from the resolution of the address.

[0107] The data management side chain device 201 includes an identity management and authentication chain module 2011, a data directory chain module 2012, a data token management module 2013, a side chain management module 2014, a data basic management module 2015 and a privacy computing management module 2016.

[0108] More specifically, the identity management and authentication chain module 2011 is used to establish an identity authentication business chain from the side chain, connect to the identity management and authentication module 1012 of the data management user device 101, store the user's identity information and permission information in the blockchain distributed ledger, and realize automatic verification of user identity and permission information and digital identity signature.

[0109] The data directory chain module 2012 is used to establish a data directory business chain from the side chain, connect to the data directory management module 1013 of the data management user device 101, store the user's data directory information in the blockchain distributed ledger, and communicate with the data management system device 301 to realize the indexing and shared management of the data directory information on the entire platform.

[0110] The data token management module 2013 connects to the token management module 1015 of the data management user device 101 through the standard data token generation and management interface, manages the token and its sequence (generation, destruction, circulation, etc.), and generates and distributes token key pairs. It calls the cross-chain module through the data management system device 301 to realize the cross-chain circulation of tokens, thereby realizing the authorization and circulation of data.

[0111] The side chain management module 2014 is used to manage the data block storage and smart contract execution of the side chain device 201. This module manages the nodes, resources, smart contracts, etc. of the side chain.

[0112] The data basic management module 2015 is used to realize data communication, transmission and basic data storage functions between the data management user device 101 and the data management system device 301 through the network communication protocol.

[0113] The privacy computing management module 2016 is used to call the privacy computing model library in the data management system device 301, configure the model in the front node of the privacy computing, obtain and calculate the encrypted data in the node, and output the results to meet various data privacy protection requirements.

[0114] The data management system device 301 includes a main chain management module 3011, a data basic management module 3012, an identity authentication chain module 3013, a data directory chain module 3014, an IPFS system module 3015, a relay cross-chain module 3016 and a privacy computing module 3017.

[0115] The main chain management module 3011 is used to create distributed ledgers, store data blocks, and execute smart contracts to implement the main chain's business functions, as well as manage the main chain's nodes, resources, smart contracts, etc.

[0116] The data basic management module 3012 is used to realize data communication and transmission between the data management user device 101 and the data management side chain device 201 through the network communication protocol, as well as the storage function of local basic data.

[0117] The identity authentication chain module 2013 is used to connect to the identity management and authentication chain module 2011 of the data management side chain device 201, initiate identity authentication of the data management user device 101 and the data management side chain device 201, and synchronize the user's main account information and public platform permission information in the distributed ledger of the main chain, thereby realizing unified authentication of identity information in the main chain system.

[0118] The data directory chain module 3014 is used to connect to the data directory chain module 2012 of the data management side chain device 201, synchronously store the user data directory information in the main chain, open it to users with permissions, and route the permission application according to the control permission registration information, so as to realize the unified management and indexing of the data directory of the entire platform.

[0119] The IPFS system module 3015 is used to be called by the data management user device 101, and realizes the distributed storage of massive data through the IPFS system, and returns the storage hash address as the address associated with the authenticated data information. When the data is authorized to be obtained by other users, the data can be obtained through the parsed IPFS address information.

[0120] The relay cross-chain module 3016 is used to provide relay chain nodes for each side chain where the data management side chain device 201 is located based on an independent server, participate in different side chains as a node arbitration, initiate cross-chain applications, responses, consensus sorting, communication and transaction writing through relay nodes, and act as an intermediary to provide blockchain-based information interaction capabilities for different side chains and between the main side chain, thereby realizing cross-chain calls of key data such as directories and tokens.

[0121] The privacy computing module 3017 is used to independently provide privacy computing front-end nodes for each platform. It can collect encrypted data from different data management side chain devices 201 with authorization to realize data computing and privacy protection among multiple users and across devices. The standardized privacy computing model configuration can also be called by the data management side chain device 201 and perform independent privacy computing within the data management side chain device 201.

[0122] FIG11 and FIG12 will further describe the data information call management process based on single authority control and dual authority control under the framework of the above-mentioned data management system.

[0123] In a single-authority control scenario, the first user terminal is the data owner and authority controller, and the second user terminal is the digital operation applicant. The data is kept by the first user terminal, and the second user terminal applies to the first user terminal for data operation permissions.

[0124] In step S1101, the second user terminal performs identity authentication to access the directory chain and obtain data directory information.

[0125] The second user terminal invokes the identity management and authentication module to perform digital identity authentication and access data directory chain C on the public management platform. This directory chain registers and shares data directory information, including that of the first user terminal. The second user terminal obtains information about the authorized data subdirectories C1 and C3 from directory chain C, including data summaries and data numbers.

[0126] In step S1102 , the second user terminal requests authorization to access data.

[0127] The second user terminal calls the data directory number and directly initiates an authorization request for the corresponding data a to the public management platform. The public management platform routes the request to the first user terminal through the information transmission module based on the data control authority registration information in the directory chain.

[0128] In step S1103 , the first user terminal accepts the data access request.

[0129] In step S1104, data operation permissions are configured for the second user terminal, and a corresponding authorization blockchain token is determined.

[0130] The database management module of the first user terminal configures the operation permissions of data a for the second user terminal and generates a token through the data token management module of the side chain platform. Depending on whether the privacy computing method is called, there are two scenarios:

[0131] When the second user terminal applies to directly obtain data a and perform permission operations, the data token management module of the side chain platform where the first user terminal is located communicates with the database management module in the first user terminal to generate a token t for asset a, or directly call a token from the pre-generated token sequence {T}.

[0132] When the second user terminal does not directly operate on data a but instead retrieves the data's privacy-preserving result, the privacy-preserving computing module of the first user terminal retrieves key information from data a, processes it according to the privacy-preserving computing model, and outputs the calculation result. The data token management module of the sidechain platform where the first user terminal resides communicates with the database management module and privacy-preserving computing module in the first user terminal, signs the calculation result, and then encrypts and compiles it to generate a token t.

[0133] In step S1105, the second user terminal obtains the first public key for parsing the blockchain token and the second public key for parsing the data identifier.

[0134] The second user terminal accesses the side chain through the database management module, signs the token t of data a and stores it in the side chain, and simultaneously obtains the first public key required to parse the token string code and the second public key required to parse the data identifier a'. The key management module of the second user terminal stores and manages the first public key and the second public key.

[0135] In step S1106, the second user terminal parses the blockchain token and the data identifier to obtain the information and metadata within the authority.

[0136] After the signature verification is passed, the second user terminal can operate the token t according to the configured permissions, parse the token information to directly obtain data information or metadata, and further achieve business goals such as data rights registration and circulation.

[0137] The second user terminal parses the token t through the database management module, retrieves the first public key to parse the token according to the encryption algorithm identifier in the header field, and obtains the data identification information a' or the key information after privacy calculation.

[0138] The second user terminal calls the second public key to parse a' and further obtain the data IPFS address hash value (a'1) or data hash information (a'2) or data block information (a'3), thereby obtaining the data within the authority.

[0139] The second user terminal returns the permission operation result for data a to the side chain platform, and the token becomes invalid or destroyed when the permission expires.

[0140] In step S1107, the second user terminal transfers the blockchain token between other user terminals.

[0141] The second user terminal can also transfer the token between multiple user devices for a limited number of times. The process is that the subsequent user applies for the token t permission from the previous user and is authorized to obtain it. When the token is transferred to the end user or when the permission expires, it becomes invalid or destroyed.

[0142] In step S1108, the operational circulation of blockchain tokens is recorded.

[0143] During the operation and circulation of token t, its records are stored in the log chain of the public management platform and shared with relevant users (such as data owners, regulatory agencies, etc.) through a cross-chain sharing mechanism, thereby achieving full process traceability.

[0144] In a dual-authority control scenario, the first user terminal is the data owner, the third user terminal is the data custodian, and both the first and third user terminals are data permission controllers. The second user terminal is the data operation applicant, and all three terminals are connected to the same blockchain sidechain platform. The second user terminal applies to the first user terminal 1 for permission to access or operate a certain data item, a. Data a is held in custodianship by the third user terminal, and authorization requires the joint approval of both the first and third user terminals. This method primarily implements technical scenarios where multiple permission controllers of data type A2 can authorize data, such as electronic certificates or electronic credentials requiring joint approval from both the user and the regulatory authority. Compared to the single-authority control scenario, dual-authority control focuses on the dual encryption and parallel authorization of the data token, t, by two user objects. To further improve the efficiency of this method for the scenario requirements, a method can be employed that pregenerates a token sequence {T} under standard permissions and directly applies for its invocation. At the same time, in order to protect user privacy in this scenario, the second user terminal can only obtain the authentication information of the third user terminal on the data, including key structured data related to the data and data hash verification information, but cannot directly obtain the data.

[0145] As shown in Figure 12, during the dual-authority control data information call management process, the second user terminal requests data access from the first user terminal and the third user terminal, respectively. The first user terminal and the third user terminal accept the requests, and then the first user terminal provides the first public key to the second user terminal, and the third user terminal provides the third public key to the second user terminal. The other steps of the dual-authority control data information call management process are the same as the single-authority control data information call management process, and their repeated description will be omitted here.

[0146] The present disclosure provides a method for applying for and invoking data through a directory chain based on the aforementioned distributed data information repository, including invoking methods for single-authority control and dual-authority control scenarios. Data information is used to generate a token, which is configured and managed by a single or dual user. When performing data invocation or manipulation, the token's permissions are actually obtained and transferred according to the required path, rather than directly reading or writing data or private data during each operation or transaction. User roles are divided into data owners, data custodians, data permission controllers, and data operation applicants to effectively separate rights such as property ownership and operational permissions in data management, thereby conforming to the role division of labor in general data management transaction scenarios. During data invocation and transfer, data security and privacy are protected through multi-level asymmetric keys or privacy computing. The user's private key is locally stored in the device's key management module, avoiding data security risks introduced by key escrow mechanisms at the platform level. Furthermore, for standardized scenarios, the permission configuration and token generation steps can be pre-processed through token batching to improve the efficiency of the method.

[0147] Figure 13 is a hardware block diagram illustrating an electronic device 1300 according to an embodiment of the present disclosure. The electronic device according to an embodiment of the present disclosure includes at least a processor and a memory for storing computer-readable instructions. When the computer-readable instructions are loaded and executed by the processor, the processor executes the data management method described above.

[0148] The electronic device 1300 shown in Figure 13 specifically includes: a central processing unit (CPU) 1301, a graphics processing unit (GPU) 1302, and a main memory 1303. These units are interconnected via a bus 1304. The central processing unit (CPU) 1301 and / or the graphics processing unit (GPU) 1302 can be used as the above-mentioned processor, and the main memory 1303 can be used as the above-mentioned memory for storing computer-readable instructions. In addition, the electronic device 1300 may also include a communication unit 1305, a storage unit 1306, an output unit 1307, an input unit 1308, and an external device 1309, which are also connected to the bus 1304.

[0149] FIG14 is a schematic diagram illustrating a computer-readable storage medium according to an embodiment of the present disclosure. As shown in FIG14 , a computer-readable storage medium 1400 according to an embodiment of the present disclosure has computer-readable instructions 1401 stored thereon. When the computer-readable instructions 1401 are executed by a processor, the data management method according to the embodiment of the present disclosure described with reference to the above figures is executed. The computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may, for example, include read-only memory (ROM), a hard disk, a flash memory, an optical disk, a magnetic disk, etc.

[0150] The above describes the blockchain-based data management method, device, system and electronic device according to the embodiments of the present disclosure with reference to the accompanying drawings. According to the blockchain-based data management method, device and system of the embodiments of the present disclosure, data is divided into three typical types according to the structured state according to the actual demand scenario of the data, and a unified management method is proposed based on the directory chain and token mechanism. The token information structure and generation method for the three typical data types provided by the embodiments of the present disclosure meet the efficient calling requirements and improve the business efficiency and security reliability of data flow. In the calling flow of data, data security and privacy are protected by multi-level asymmetric keys or privacy computing. The private key on the user side is locally stored through the key management module in the device, avoiding the data security risks brought by the key hosting mechanism at the platform layer. In addition, for standardized scenarios, the permission configuration and token generation links are pre-positioned by token batch preprocessing to improve the efficiency of the method.

[0151] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0152] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0153] The block diagrams of the devices, devices, equipment, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "include," "comprise," "have," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0154] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0155] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0156] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0157] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0158] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A data management method based on blockchain, the method comprising: Based on a plurality of metadata types, generating a corresponding plurality of sub-directories, wherein the plurality of metadata types include unstructured data types, semi-structured data types, and structured data types; Determining a data identifier and a storage location of the data based on a metadata type of the data, wherein the storage locations of the unstructured data type, the semi-structured data type, and the structured data type are different; and Based at least on the plurality of sub-directories and the data identifier, the data is stored and managed.

2. The data management method according to claim 1, wherein: The step of determining the data identifier and storage location of the data based on the metadata type of the data includes: If the metadata type of the data is the unstructured data type, the data is stored in a distributed storage system, a hash value of a storage address of the data in the distributed storage system is stored in a blockchain where the first user terminal to which the data belongs is located, and the hash value of the storage address is determined as a data identifier of the data in the block information of the blockchain; If the metadata type of the data is the semi-structured data type, the data is stored in the first user terminal, a hash value of the data is stored in the blockchain where the first user terminal is located, and the hash value of the data is determined as a data identifier of the data in the block information of the blockchain; If the metadata type of the data is the structured data type, the data is stored in the blockchain to which the first user terminal belongs, and the block information of the data in the blockchain is determined as the data identifier of the data.

3. The data management method according to claim 1 or 2, further comprising: Determining standardized information of the data, wherein the standardized information includes data summary information, authority information, key information and the data identifier of the data; and A blockchain token for the data is generated based on the standardized information, wherein the corresponding blockchain tokens of the unstructured data type data, the semi-structured data type data, and the structured data type data of the first user terminal constitute a blockchain token sequence of the first user terminal.

4. The data management method according to claim 3, further comprising: In response to a second user terminal's authorization request for the data to be accessed, configuring data operation permissions for the second user terminal and determining a corresponding authorization blockchain token, The authorized blockchain token is used by the second user terminal to operate within the data operation authority and access The data to be accessed is asked.

5. The data management method according to claim 4, wherein: Determining the corresponding blockchain token includes: Calling the blockchain token corresponding to the data to be accessed from the blockchain token sequence as the authorized blockchain token; or A private data call is performed for the data to be accessed, and the authorization blockchain token is generated based on the private data.

6. The data management method according to claim 3, further comprising: Generate data directory information based on the unstructured data type data, the semi-structured data type data and the structured data type data of the first user terminal, and the corresponding standardized information; The data directory information is stored in a directory chain where the first user terminal is located.

7. The data management method according to claim 3, wherein: The blockchain token corresponds to a first public key managed by the first user terminal and a second public key managed by a third user terminal, The data management method further comprises: In response to a second user terminal's authorization request for the data to be accessed, providing the first public key to the second user terminal, Among them, the first public key is used by the second user terminal to operate the blockchain token within the predetermined data operation authority, and the second public key is used by the second user terminal to access the data to be accessed within the predetermined data operation authority.

8. A data management method based on blockchain, the method comprising: generating a data directory chain based on data of a plurality of metadata types belonging to a user terminal, wherein the plurality of metadata types include unstructured data types, semi-structured data types, and structured data types, and the data directory chain includes sub-directories corresponding to the plurality of metadata types; and Based on the multiple metadata types, data identifications of the data are stored.

9. A data management device based on blockchain, the device comprising: A subdirectory management unit is configured to generate a corresponding plurality of subdirectories based on a plurality of metadata types, wherein the plurality of metadata types include unstructured data types, semi-structured data types, and structured data types; The data management unit is configured to determine the data identification and storage location of the data based on the metadata type of the data; and store and manage the data based at least on the multiple sub-directories and the data identification, wherein the unstructured The storage locations of the data types, the semi-structured data types, and the structured data types are different.

10. A data management device based on blockchain, the device comprising: a data directory chain management unit configured to generate a data directory chain based on data of a plurality of metadata types belonging to a user terminal, wherein the plurality of metadata types include unstructured data types, semi-structured data types, and structured data types, and the data directory chain includes sub-directories corresponding to the plurality of metadata types; and The data identification management unit is configured to store the data identification of the data based on the multiple metadata types.

11. A data management system based on blockchain, the system comprising: A data management user device, configured to generate a corresponding plurality of sub-directories based on a plurality of metadata types, determine a data identifier and a storage location of the data based on the metadata type of the data, and store and manage the data based at least on the plurality of sub-directories and the data identifier; A data management side chain device, used for storing and managing directory chain information of a plurality of sub-directories generated by the data management user device and data identifiers of the data; as well as The data management system device is used to provide communication control for one or more of the data management user devices and one or more of the data management side chain devices, and store and manage the directory chain information of one or more of the data management side chain devices.

12. An electronic device comprising: a memory for storing computer readable instructions; as well as A processor, configured to run the computer-readable instructions so that the electronic device executes the blockchain-based data management method as described in any one of claims 1 to 8.

13. A non-transitory computer-readable storage medium for storing computer-readable instructions, wherein: When the computer-readable instructions are executed by a processor, the processor is caused to perform the blockchain-based data management method according to any one of claims 1 to 8.

Images