WO2022121058A1

WO2022121058A1 - Blockchain-based trusted sharing method for protection of privacy-related government data

Info

Publication number: WO2022121058A1
Application number: PCT/CN2020/142468
Authority: WO
Inventors: 吴志雄; 黄文峰; 汪翔; 肖伟
Original assignee: 南威软件股份有限公司
Priority date: 2020-12-09
Filing date: 2020-12-31
Publication date: 2022-06-16
Also published as: CN112417510A; CN112417510B

Abstract

The present invention relates to a blockchain-based trusted sharing method for the protection of privacy-related government data. A blockchain is introduced to resolve trust issues between data managers, data sharers, data associated parties, and data users. Strict authorization, application, and use mechanisms ensure that data can only be used by authorized users. More data verification logics are integrated into a blockchain-based smart contract so as to form a mechanism in which data is "available but invisible". In addition, blockchain-based distributed identities allow all the involved people, systems, and data to have corresponding identities and digital certificates, such that the whole process is traceable and non-repudiable.

Description

A trusted sharing method for protecting government privacy data based on blockchain

technical field

The invention belongs to government affairs data sharing, block chain, and government affairs service information application, and particularly relates to a trusted sharing method for protecting government affairs privacy data based on block chain.

Background technique

The sharing of government data usually refers to all kinds of basic data generated by government agencies in the process of power operation, such as population, enterprises, engineering projects, electronic licenses and other information. Under the traditional informatization structure, each government agency manages the basic data generated by itself, forming an information island, which makes the process of improving service efficiency in the government slow.

After the informatization construction in recent years, more and more regions have adopted the data sharing framework for the information application of basic government data. Corresponding basic government data. However, it is difficult for such application models to further help government informatization construction authorities to break through the deep-water areas of reform and maximize the value of data. The main reason is that most of the data generated by various government agencies are private information involving citizens or enterprises. Under the existing data sharing center model, it is difficult for various government agencies to open data, and it is difficult to ensure that there is a good privacy protection mechanism in the whole process of data sharing and exchange, and it is difficult for various government agencies to generate unified trust. This leads to the dilemma that the data that the data application party wants to use is not open, and the open data does not want to be used. Therefore, it is necessary to have a technology and security mechanism that can be traced throughout the whole process and that the privacy information can be invisible to eliminate the data security concerns generated by various government agencies. A new trust mechanism.

technical problem

The purpose of the present invention is to provide a trusted sharing method for protecting government affairs privacy data based on blockchain, so as to realize the whole process traceability of government affairs privacy data, the technology and security mechanism that the privacy information is available and invisible, and eliminate the data generated by various government agencies. security concerns, and promote the sharing of basic government information.

technical solutions

In order to achieve the above purpose, the technical solution of the present invention is: a trusted sharing method for protecting government privacy data based on blockchain. First, a consortium blockchain network base for supporting data sharing and exchange is established, including government agencies, The data users and the relevant systems of the government data sharing center are the participants of the blockchain network, and each assigns an exclusive blockchain distributed identity; Its blockchain distributed identity signs the data, and according to different application modes, the government data sharing center provides data services or data packages to confirm the data rights; when the data is applied, the data user initiates authorization to the related parties of the government affairs privacy data , based on the block chain to provide the generation and recording of authorization requests, and finally through the block chain smart contract with business characteristics, the signature data is verified, the authorization information is verified, and the privacy data is processed based on the smart contract business. Feed back the final data processing or verification results to the data consumer.

In an embodiment of the present invention, the data right confirmation path for government privacy data is as follows: (2.1) Government agencies register distributed identities to generate blockchain distributed identities on the blockchain and generate a digital certificate; ( 2.2) Government agencies sort out government privacy data, generate data catalogs, privacy data information elements, and application APIs for privacy information, and submit them to the government data sharing center for registration; (2.3) The government data sharing center generates data that can be shared with data users Since each data directory may include private data information elements provided by multiple government agencies, it is necessary to include the government agency information and blockchain identity corresponding to the data directory and the private data information elements corresponding to the directory. Confirm rights and record on the consortium blockchain for data sharing and exchange.

In an embodiment of the present invention, the data authorization path of government privacy data is as follows: (3.1) When the data related party of government privacy data needs to use government affairs privacy data, an authorization request is initiated through the data user system, and then managed by identity verification authorization (3.2) When the data related party applies for the authorization of government privacy data, the real identity information of the data related party is used to register the distributed data on the blockchain. Identity, let the data related parties have a corresponding blockchain distributed identity on the blockchain, and generate a digital certificate; (3.3) The system of identity verification and authorization management is based on the user's real identity information and the verification result of the real person. Officially initiate an authorization application to the blockchain. Each authorization application needs to clearly include the authorized data directory, authorized object information, authorization period, authorization purpose, and data related party signature information, and after verification in the blockchain is passed. (3.4) After receiving the authorization application, the alliance blockchain for data sharing and exchange will verify the information through the smart contract. After the verification is passed, the smart contract will generate an authorization code, and the information of the authorization application, The result of authorization verification and authorization code are recorded on the blockchain and returned to the system related to identity verification and authorization management; (3.5) The data user obtains the authorization code.

In an embodiment of the present invention, in step (3.5), the methods for the data user to obtain the authorization code include scanning the code, verbal notification, and interface notification.

In an embodiment of the present invention, the data usage path of government privacy data is as follows: (4.1) The data user registers a distributed identity on the blockchain, so that the data user has a one-to-one corresponding blockchain on the blockchain Distributed identity, a digital certificate is generated; (4.2) After the data user obtains the authorization code, it will apply to the government data sharing center with the authorization code to use the data; (4.3) The government data sharing center will submit the data user information and authorization code. Go to the blockchain and apply for verification authorization. If the authorization verified by the blockchain is passed, the data use application behavior of the data user and the government data sharing center will be recorded; (4.4) The government data sharing center will receive the blockchain When the authorization verification is passed, the data user will be notified; (4.5) After the government affairs data sharing center completes the notification of the authorization result, the authorization code, data user certificate, data directory, and data related party information will be confirmed through the data. The registered API submits an application for the use of government privacy data; (4.6) Government agencies use data user certificates, authorization codes, and data related party information to encrypt government privacy data, and use their own distributed identity digital certificates to sign the encrypted data. , and submit it to the blockchain; after the blockchain receives the data, it decrypts and verifies the received data according to the recorded data catalog and the corresponding smart contract. After the data verification is passed, encrypts and signs the data submitted by the government agency (4.7) After receiving the notification of the authorization result, the data user will use the blockchain open privacy data acquisition service to query government privacy data; the blockchain receives the query government privacy data After the application of the data, based on the smart contract, according to the authorization code and the data user certificate, the privacy information associated with the authorization submitted by each government agency will be found, verified and decrypted in the smart contract, and returned to government affairs according to the needs of the business. Calculation results of private data or partial information of government privacy data.

In an embodiment of the present invention, in step (4.5), the application for use is submitted according to the number of data catalogs. If the private data of multiple government agencies is involved, an application will be initiated to these government agencies at the same time.

beneficial effect

Compared with the prior art, the present invention has the following beneficial effects: 1. The sharing of government privacy data is completed by the participation of the data management party, the data sharing party, the data related party and the data user, and the multi-node authentication of the blockchain .

2. The whole process of sharing government privacy data is highly secure. From the identity verification of the requester, the encryption protection of privacy data, and the decryption calculation of smart contracts, the desired results or information elements can only be obtained in the final link.

3. Innovation in technical application. The usual blockchain and digital signature applications are only used in the process of signing and verifying signatures. This method takes into account the distrust factors such as human beings and technical codes. The digital signature is combined with the authorization control process to form a new application process.

Description of drawings

FIG. 1 is a schematic flowchart of a trusted sharing method for protecting government privacy data based on blockchain according to the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

The technical solutions of the present invention will be described in detail below with reference to the accompanying drawings.

The present invention provides a trusted sharing method for protecting government privacy data based on blockchain. First, a consortium blockchain network base for supporting data sharing and exchange is established, including government agencies, data users, and government data sharing centers. Relevant systems, as participants of the blockchain network, each assign an exclusive blockchain distributed identity; secondly, they process the government privacy data generated by various government agencies before sharing, and use their blockchain distributed identity to process the data. Sign, according to different application modes, provide data services or data packages, and the government data sharing center will confirm the data rights; when the data is applied, the data user initiates authorization to the related parties of the government affairs privacy data, and provides authorization requests based on the blockchain. Generate and record, and finally verify the signature data, verify the authorization information, process the private data based on the smart contract business through the blockchain smart contract with business characteristics, and process the final data or verify the result. Feedback to data consumers.

The following is a specific implementation process of the present invention.

As shown in Figure 1, the method of the present invention firstly establishes an alliance block chain network base for supporting data sharing and exchange, and each government agency, data user, government affairs sharing data center and other related systems participate in the block chain network party and assign an exclusive blockchain distributed identity. Secondly, special processing is done before the private data generated by various government agencies is shared, and the data is signed using its blockchain distributed identity. According to different application modes, data services or data packages are provided and the data rights are confirmed by the government data sharing center; In the application of data, authorization will be initiated through the data user to the related parties of the privacy data, such as individuals or enterprises, the generation and recording of authorization requests will be provided based on the blockchain, and finally the signature will be signed through a blockchain smart contract with business characteristics. The data is verified, the authorization information is verified, the private data is processed based on the smart contract business, and the final data processing or verification result is fed back to the data user. The whole process can ensure that government privacy data will not be easily obtained by data users, and ensure that the whole process of data generation, processing and use is recorded through blockchain distributed identity, and multi-process can be carried out from confirmation, authorization, and verification. Trust computing, realize "data use after authorization", "data use on demand", "data availability is invisible", and realize the security, credibility, traceability and non-tampering of the whole process of government privacy data sharing.

Specifically, the present invention starts from the technical solution process of the whole process from the confirmation of government affairs privacy data, the authorization of government affairs privacy data to the use of government affairs privacy data, and the application-related points of the blockchain.

In terms of right confirmation of government privacy data, the government affairs data sharing center is used to manage the catalogue and the blockchain is used to confirm rights on the chain; in terms of authorization of government affairs privacy data, the relevant subjects of the data use the blockchain distributed identity as the Support and generate authorization information; in terms of the use of government privacy data, through a unified standard specification, on the one hand, the distributed identity of the authorized party is verified, and on the other hand, the validity and authenticity of the authorization information are verified, and through the blockchain The smart contract controls the encryption and decryption mechanism to ensure that government privacy data can be applied under a new trust mechanism based on the already constructed government data sharing center.

1. Confirmation path of government privacy data: 1. Data providers register distributed identities, and government privacy data in a certain region is usually generated and managed by various data management agencies, such as the Public Security Bureau, Civil Affairs Bureau, etc. Before private data is applied through the government data sharing center, it is necessary to use the real information of the organization to register distributed identities on the alliance blockchain for data sharing and exchange for the information system of the organization to manage the government privacy data, so that such information systems can be distributed in the district. There is a one-to-one corresponding blockchain distributed identity on the blockchain, which generates a digital certificate.

2. For API and data catalog registration, the organization will sort out the available government privacy data, generate data catalogs, privacy data information elements, and application APIs for privacy information, and submit these information to the Government Affairs Data Sharing Center for registration.

For example, the citizen household registration information catalogue is provided by the Public Security Bureau, including private data information elements such as name, ID number, home address, and place of origin. The API for application is http://ip:port/v1/person/info.

For example, the civil marriage information catalog is provided by the Civil Affairs Bureau, including name, ID number, home address, place of origin, marriage registration, basic spouse information and other private data information elements. The API for application is http://ip:port/v1 /marriage/info.

3. The data catalogue is confirmed and filed. According to its internal data sorting, governance, sharing and opening and other functions, the government affairs data sharing center will list the final data catalogues of government affairs privacy data that can be shared with data users. Each data catalogue may include multiple The private data information elements provided by the organization, so it is necessary to confirm the rights of the data providing organization information and blockchain identity corresponding to the data catalog and the private data information elements corresponding to the catalog, and record on the consortium blockchain for data sharing and exchange. .

For example, the basic citizen information catalogue is formed based on the household registration information catalogue provided by the Public Security Bureau and the marriage information catalogue provided by the Civil Affairs Bureau. The elements of privacy information are sorted out, including the name, ID number, home address, place of origin and other privacy information provided by the household registration information catalogue system of the Public Security Bureau. The elements of data information also include elements of private data information such as marriage registration and basic spouse information provided by the Civil Affairs Bureau’s marriage information catalog. The Government Affairs Data Sharing Center will sort out such information catalogues according to business needs, and record the catalogue information, associated element information, and provider information of element information on the blockchain.

The data catalog is sorted by the government affairs data sharing center according to the actual business, and the private data information elements required by the business can be selected from the basic data catalog provided by 1-N units.

At this point, the record of data confirmation is completed.

2. Authorization path of government privacy data: 1. Application for authorization of privacy data. When individuals or enterprises need to use government privacy data, they can initiate a request through the data user system, and perform authorization confirmation in the relevant system of identity verification and authorization management; Authorization confirmation can be performed directly in the relevant system of identity verification and authorization management.

The relevant system of identity verification and authorization management is a related product system that provides distributed identity application, query data directory, and authorization management of private data of individuals or enterprises according to the alliance blockchain foundation of data sharing and exchange. This system can exist alone or It can be integrated into some existing product systems according to business needs.

When individuals or enterprises apply for data authorization, they need to select 1-N data directories and authorize them.

2. The data related party registers the distributed identity. When the data related party (individual or enterprise) applies for authorization, it will use the real identity information of the related party to register the distributed identity on the blockchain, so that the data related party can register on the blockchain. There is a corresponding blockchain distributed identity, and a digital certificate is generated to provide signature and signature verification applications for the authorization of their private data, ensuring that the use of private data is their own participation, non-repudiation, and traceable.

If you have already registered users, this step can be skipped.

3. Private data use authorization, identity verification and authorization management The related system officially initiates an authorization application to the blockchain according to the user's real identity information and the actual person verification result. Each authorization application requires a clear authorized data directory and authorized object information. , the duration of the authorization, the purpose of the authorization, the signature information of the data related party, etc. These information will be recorded after being verified in the blockchain.

4. The data related party obtains the authorization code. After receiving the authorization application, the alliance blockchain for data sharing and exchange will verify the information through the smart contract. After the verification is passed, the smart contract will generate an authorization code and apply for authorization. The information, authorization verification results and authorization codes are recorded on the blockchain and returned to the identity verification authorization management system.

5. The data user obtains the authorization code, and the data user obtains the authorization code by scanning the code, verbal notification, and interface notification.

At this point, the application and transfer of data authorization is completed.

3. The use path of government privacy data: 1. The data user registers the distributed identity, and the data user registers the distributed identity on the blockchain with its system description information and system manager information, so that the data user can register the distributed identity on the blockchain. There is a one-to-one corresponding blockchain distributed identity, a digital certificate is generated, and a signature and signature verification application is provided for its data use application to ensure that the use of privacy is initiated by its system, which is non-repudiation and traceable.

If you have already registered users, this step can be skipped.

2. The business system of the data user applies for the use of data. After the data user obtains the authorization code, the data user carries the authorization code to apply for the use of the data to the Government Affairs Data Sharing Center.

3. Authorization code verification, the government data sharing center submits the user information, authorization code, etc. to the blockchain, and applies for verification of authorization behavior. If the authorization behavior verified by the blockchain is passed, the data user and the government data sharing center will be recorded. data usage application behavior.

4. Notify the authorization result. The government data sharing center will receive the verification result of the blockchain, and will notify the data user when the authorization verification is passed.

5. To apply for private data, after the government affairs data sharing center completes the notification of the authorization result, the authorization code, user certificate, data directory, and data related party information will be submitted through the API of data rights confirmation and registration to submit the application for the use of private data.

This application is based on the actual data catalog. If the private data of multiple institutions is involved, an application will be made to these institutions at the same time.

6. The institution submits private data. The institution encrypts the private data with the user certificate, authorization code, and data related party information, and uses its own distributed identity digital certificate to sign the encrypted data and submit it to the blockchain.

After the blockchain receives the data, it decrypts and verifies the received data according to the recorded data catalog and the corresponding smart contract. After the data verification is passed, the encrypted and signed private data submitted by the institution is recorded in the blockchain. on the ledger.

7. To obtain private data, the data user will use the blockchain open private data acquisition service to query the private data after receiving the notification of the authorization result.

After receiving the application for querying private data, the blockchain will find the private information associated with this authorization submitted by each institution based on the authorization code and user certificate based on the smart contract, and verify and decrypt it in the smart contract. It returns the calculation result of the private data or some information of the private data.

The method of the invention solves the trust crisis of the data management party, the data sharing party, the data related party and the data user by introducing the blockchain, and ensures that the data can be used by the authorized party through strict authorization, application and use mechanism. More data verification logic is put into the blockchain smart contract, forming a mechanism of "available and invisible" data, and through the distributed identity of the blockchain, the people, systems, and data participating in it have corresponding identities and identities. The digital certificate is fully traceable and non-repudiation. Under this mechanism, the features of the present invention are as follows: 1. For the data catalogue managed by the government affairs data sharing center, record the data through the blockchain to confirm the right of the data, and each business and data catalogue has a corresponding smart contract, Dynamically meet the needs of the business to protect and respond to private data; 2. Increase data related parties to generate authorization codes on the blockchain, so that the use of government privacy data must be authorized by related parties, making data use more rigorous; 3. Government privacy After data processing, it is directly submitted to the blockchain instead of the government data sharing center, which reduces the risk of leakage of private information in the data processing of the government data sharing center; 4. All participants, including people or systems, are on the blockchain There is a one-to-one corresponding distributed identity, which increases the security, traceability, and non-repudiation of the whole process; 5. Distinguish the three behavioral processes of data authorization application, data use application, and data use, so that the needs of a government privacy data sharing The whole process of authorization, application and use can be traced back.

The above are the preferred embodiments of the present invention, all changes made according to the technical solutions of the present invention, when the resulting functional effects do not exceed the scope of the technical solutions of the present invention, belong to the protection scope of the present invention.

Claims

A trusted sharing method for protecting government privacy data based on blockchain is characterized in that, first, a consortium blockchain network base for supporting data sharing and exchange is established, including government agencies, data users, and government data sharing centers The relevant systems of the blockchain network act as participants in the blockchain network, and each assigns an exclusive blockchain distributed identity; secondly, it processes the government privacy data generated by various government agencies before sharing, and uses its blockchain distributed identity to The data is signed, and according to different application modes, data services or data packages are provided by the government data sharing center to confirm the data rights; when the data is applied, the data user initiates authorization to the related parties of the government affairs privacy data, and provides authorization requests based on the blockchain Finally, through the blockchain smart contract with business characteristics, the signature data is verified, the authorization information is verified, the privacy data is processed based on the smart contract business, and the final data is processed or verified. The results are fed back to the data consumer.
A trusted sharing method for protecting government privacy data based on blockchain according to claim 1, wherein the data right confirmation path of government privacy data is as follows:

(2.1) Government agencies register distributed identities to generate blockchain distributed identities on the blockchain and generate a digital certificate;

(2.2) Government agencies sort out government privacy data, generate data catalogs, privacy data information elements, and application APIs for privacy information, and submit them to the government data sharing center for registration;

(2.3) The government data sharing center generates a list of government privacy data directories that can be shared with data users. Since each data directory may include private data information elements provided by multiple government agencies, it is necessary to combine the data directory and the privacy data corresponding to the directory. The government agency information and blockchain identity corresponding to the data information elements are confirmed and filed on the consortium blockchain for data sharing and exchange.
A trusted sharing method for protecting government privacy data based on blockchain according to claim 2, wherein the data authorization path of government privacy data is as follows:

(3.1) When the data related party of government privacy data needs to use government privacy data, an authorization request is initiated through the data user system, and then the authorization is confirmed by the relevant system of identity verification and authorization management; or directly through the relevant system of identity verification and authorization management Confirm authorization;

(3.2) When the data related party applies for the authorization of government privacy data, the real identity information of the data related party is used to register the distributed identity on the blockchain, so that the data related party has a one-to-one corresponding blockchain distributed identity on the blockchain. identity, resulting in a digital certificate;

(3.3) The system related to identity verification and authorization management formally initiates an authorization application to the blockchain according to the user's real identity information and the verification result of the real person. Each authorization application needs to clearly include the authorized data directory, authorized object information, authorized Term, purpose of authorization, signature information of data related parties, and record after verification in the blockchain;

(3.4) After receiving the authorization application, the alliance blockchain for data sharing and exchange will verify the information through the smart contract. After the verification is passed, the smart contract will generate an authorization code, and the information of the authorization application, the authorization verification The result and authorization code are recorded on the blockchain and returned to the system related to identity verification and authorization management;

(3.5) The data user obtains the authorization code.
A trusted sharing method for protecting government privacy data based on blockchain according to claim 3, characterized in that, in step (3.5), the way for the data user to obtain the authorization code includes scanning code, oral notification, interface notification .
A trusted sharing method for protecting government privacy data based on blockchain according to claim 3, wherein the data usage path of government privacy data is as follows:

(4.1) The data user registers a distributed identity on the blockchain, so that the data user has a corresponding blockchain distributed identity on the blockchain, and generates a digital certificate;

(4.2) After obtaining the authorization code, the data user shall apply for the use of data to the Government Data Sharing Center with the authorization code;

(4.3) The government data sharing center will submit the data user information and authorization code to the blockchain, and apply for verification of the authorization behavior. If the authorization behavior verified by the blockchain is passed, the data of the data user and the government data sharing center will be recorded. use the application behavior;

(4.4) The government affairs data sharing center will receive the verification result of the blockchain, and will notify the data user when the authorization verification is passed;

(4.5) After the government data sharing center completes the notification of the authorization result, it submits the authorization code, data user certificate, data directory, and data related party information through the API for data authorization registration to submit the application for the use of government privacy data;

(4.6) Government agencies use the data user certificate, authorization code, and data related party information to encrypt government privacy data, and use their own distributed identity digital certificate to sign the encrypted data and submit it to the blockchain; the blockchain receives After the data is received, decrypt and verify the received data according to the recorded data catalog and the corresponding smart contract. After the data verification is passed, the encrypted and signed private data submitted by the government agency is recorded on the blockchain ledger;

(4.7) After receiving the notification of the authorization result, the data user will use the blockchain open privacy data acquisition service to query government privacy data; after the blockchain receives the application for querying government privacy data, it will be based on the smart contract. Authorization code, data user certificate, find the privacy information associated with this authorization submitted by various government agencies, verify and decrypt in the smart contract, and return the calculation result of government privacy data or part of government privacy data according to business needs information.
A trusted sharing method for protecting government privacy data based on blockchain according to claim 5, characterized in that, in step (4.5), the application for use is submitted according to the number of data catalogs, and if multiple government agencies are involved The private data will be applied to these government agencies at the same time.