WO2020073828A1 - 审计结果数据存储、查询方法、审计项存储方法及装置 - Google Patents

审计结果数据存储、查询方法、审计项存储方法及装置 Download PDF

Info

Publication number
WO2020073828A1
WO2020073828A1 PCT/CN2019/108666 CN2019108666W WO2020073828A1 WO 2020073828 A1 WO2020073828 A1 WO 2020073828A1 CN 2019108666 W CN2019108666 W CN 2019108666W WO 2020073828 A1 WO2020073828 A1 WO 2020073828A1
Authority
WO
WIPO (PCT)
Prior art keywords
audit
user
hash value
result data
signature data
Prior art date
Application number
PCT/CN2019/108666
Other languages
English (en)
French (fr)
Inventor
汪东艳
李茂材
李波
屠海涛
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2020073828A1 publication Critical patent/WO2020073828A1/zh
Priority to US17/073,191 priority Critical patent/US11316669B2/en
Priority to US17/700,433 priority patent/US11700113B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/36—User authentication by graphic or iconic representation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0637—Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105—Dual mode as a secondary aspect

Definitions

  • This application relates to the field of data storage, in particular to an audit result data storage, query method, audit item storage method and device.
  • Audit refers to the independent supervision activities of the pre- and post-examination review of the major projects and financial revenues and expenditures of the government, financial institutions, enterprises and institutions at all levels of the country in accordance with the law by the specialized agencies.
  • Network security audits As a monitoring mechanism, auditing has a long history of practical activities.
  • the current auditing method is generally the manual auditing of the materials submitted by the audited units by various audit institutions, which involves the transmission of a large amount of paper materials The transmission is not only environmentally friendly, but also more unfavorable for data storage and confidentiality.
  • an audit result data storage, query method, and audit item storage method and device are provided.
  • An audit result data storage method executed by the first electronic device, includes:
  • An audit result data storage method executed by a second electronic device, includes:
  • first signature data where the first signature data is used to represent the audit result data of the first user
  • An audit result data storage method is executed by any node device in the audit result data storage subsystem.
  • a plurality of node devices in the audit result data storage subsystem are configured with a consensus mechanism, including:
  • Second signature data sent by a second electronic device, where the second signature data is used to represent a first hash value signed by the first user as the audited party and the second user as the auditing party, the first The hash value is used to represent the audit result data of the first user;
  • the second signature data is broadcast in the audit result data storage subsystem.
  • the second signature data is stored in the audit result data storage subsystem.
  • An audit result data query method executed by a third electronic device, includes:
  • An audit item storage method executed by the audit item storage subsystem, includes:
  • the audit item to be entered is not stored.
  • An audit result data storage device including:
  • a hash acquisition module for acquiring the first hash value of the audit result data of the first user
  • a signature module configured to sign the first hash value according to the private key of the first user to obtain first signature data
  • the sending module is used to send the first signature data to the audit result data storage subsystem, and the audit result data storage subsystem is used to store data in the form of a blockchain.
  • An audit result data storage device including:
  • a receiving module configured to receive second signature data sent by a second electronic device, and the second signature data is used to represent a first hash value signed by the first user as the auditee and the second user as the auditee , The first hash value is used to represent the audit result data of the first user;
  • a verification module configured to verify the second signature data
  • a sending module configured to broadcast the second signature data in the audit result data storage subsystem when the verification is passed;
  • the storage module is configured to store the second signature data in the audit result data storage subsystem when the audit result data storage subsystem passes consensus on the second signature data.
  • An audit result data query device including:
  • the address acquisition module is used to obtain the page link address of the query page of the third user by scanning the third graphic identification code provided by any electronic device;
  • a sending module for sending a webpage access request, the webpage access request for accessing the page link address of the query page of the third user
  • a display module is used to display the query page of the third user, and the query page includes the audit result of the third user.
  • An audit item storage device including:
  • Audit item entry module used to obtain audit items to be entered
  • a hash obtaining module configured to obtain a second hash value of the audit item to be entered
  • the query module is configured to query the hash value of the existing audit item in the audit field to which the audit item to be entered belongs based on the second hash value;
  • the storage module is configured to not store the audit item to be entered when the hash value of the existing audit item includes the same hash value as the second hash value.
  • An audit result data storage method including:
  • the first electronic device obtains the first hash value of the audit result data of the first user, and signs the first hash value according to the first user's private key to obtain the first signature data;
  • the second electronic device After acquiring the first signature data, the second electronic device signs the first signature data according to the private key of the second user to obtain second signature data, and sends the second signature data to the audit result data Storage subsystem;
  • the audit result data storage subsystem After receiving the second signature data, the audit result data storage subsystem stores the second signature data in the audit result data storage subsystem if the second signature data is passed by consensus.
  • An audit system including: an audit item storage subsystem, an on-site audit subsystem, at least one electronic device, and an audit result data storage subsystem;
  • the audit item storage subsystem is used to store multiple audit items
  • the on-site audit subsystem is used to interact with the audit item storage subsystem to provide an audit page of the first user to obtain audit result data of the first user, which is the first electronic device in the at least one electronic device
  • the device provides the first hash value of the audit result data of the first user
  • the first electronic device is used to sign the first hash value according to the first user's private key to obtain first signature data
  • the second electronic device is used to sign the first signature data according to the second user's private key to obtain second signature data, and send the second signature data to the audit result data storage subsystem;
  • the audit result data storage subsystem is used to store the second signature data in the form of a blockchain.
  • An electronic device includes a memory and a processor.
  • a computer program is stored in the memory, and when the computer program is executed by the processor, the processor is caused to perform the steps of the foregoing method for storing audit result data.
  • An electronic device includes a memory and a processor.
  • a computer program is stored in the memory.
  • the processor causes the processor to perform the steps of the audit result data query method.
  • An electronic device includes a memory and a processor.
  • a computer program is stored in the memory, and when the computer program is executed by the processor, the processor is caused to perform the steps of the above method for storing audit items.
  • a computer-readable storage medium stores a computer program, and when the computer program is executed by one or more processors, causes the one or more processors to perform the steps of any of the above methods.
  • FIG. 1 is a system architecture diagram of an audit system provided by an embodiment of the present application
  • FIG. 2 is a functional composition diagram related to entry of an audit item provided by an embodiment of the present application
  • 3A is a schematic diagram of an audit item entry process provided by an embodiment of the present application.
  • 3B is a schematic diagram of a relationship between an audit field and a semantic template provided by an embodiment of the present application
  • FIG. 3C is a schematic diagram of a metadata-based feature value storage provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an audit result data storage subsystem 103 provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of a method for storing audit result data according to an embodiment of the present application
  • FIG. 6 is a flowchart of an example of a method for storing audit result data according to an embodiment of the present application
  • FIG. 8 is a flowchart of an example of an audit result data storage method provided by an embodiment of the present application.
  • FIG. 10 is an example diagram of a merkel tree provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of an audit result data storage device provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of an audit result data storage device provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of an audit result data storage device provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of an audit result data query device provided by an embodiment of the present application.
  • 15 is a schematic structural diagram of an audit item storage device provided by an embodiment of the present application.
  • 16 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • FIG. 1 is a system architecture diagram of an audit system provided by an embodiment of the present application.
  • the audit system includes an audit item storage subsystem 100, an on-site audit subsystem 101, at least one electronic device 102, and an audit result data storage subsystem 103.
  • the audit item storage subsystem 100 is used to store audit items.
  • the stored audit items may be pre-configured by a system administrator or uploaded by users in the system.
  • the on-site audit subsystem 101 can establish a data connection with the audit item storage subsystem 100.
  • the on-site audit subsystem 101 can obtain the audit objects input by the auditors. Audit items associated with the audit object.
  • the auditor can audit the audit items associated with the audit object on the on-site audit subsystem 101 to obtain audit result data.
  • the on-site audit subsystem 101 can generate the first hash value of the audit result data based on the audit result data. Based on the first hash value, the audit subsystem generates a first graphic identification code and displays it on the screen of the on-site audit subsystem 101.
  • the first electronic device may scan the first graphical identification code to obtain a first hash value corresponding to the first graphical identification code, and send the first hash value to the corresponding trusted execution environment, which may be based on The private key of the user of the first electronic device signs the first hash value to obtain first signature data, and sends the first signature data to the first electronic device.
  • the first electronic device After receiving the first signature data, the first electronic device sends the first signature data to the audit result data storage subsystem 103.
  • the audit result data storage subsystem 103 sends the first certificate of proof to the second electronic device.
  • the first signature data is obtained from the audit result data storage subsystem 103, and the second electronic device sends the first signature data to the trusted execution environment of the second electronic device
  • the first signature data is signed according to the private key of the user of the second electronic device to obtain second signature data
  • the second signature data is sent to the second electronic device.
  • the second electronic device After receiving the second signature data, the second electronic device sends the second signature data to the audit result data storage subsystem 103.
  • the audit result data storage subsystem 103 is used to store data in the form of a blockchain.
  • the audit item storage subsystem 100 may include a server and multiple user-side devices. The user may upload the audit items to the server through the user-side device to implement centralized storage.
  • the audit item storage subsystem 100 may be in a decentralized form, that is, the audit item storage subsystem 100 includes multiple node devices, and each node device is configured with the same blockchain. To store the audit items passed by the consensus of multiple node devices to achieve decentralized data storage to improve data security.
  • this system architecture when storing audit items, it can include hash processing, first-level judgment (consistency judgment), semantic processing, and second-level judgment (similar Degree determination) and the third-level determination (manual evaluation) process steps (as shown in Figure 2).
  • the above process includes: obtaining the audit item to be entered; obtaining the second hash value of the audit item to be entered; based on the second hash value, the hash of the existing audit item in the audit field to which the audit item to be entered belongs Query among the column values; when the hash value of the existing audit item includes the same hash value as the second hash value, the audit item to be entered is not stored.
  • the audit item to be entered is determined to be a duplicate item, and the audit item to be entered is not stored; when the existing audit items include the audit items to be entered When the audit items whose similarity is less than the second similarity threshold, the audit item to be entered can be entered into the audit item; and, when the existing audit items include the similarity with the audit item to be entered is less than the first similarity
  • the threshold audit items determine whether to store the audit items to be entered based on the manual evaluation results.
  • the similarity may be a similarity determined based on semantic analysis. For cases where there is no same hash value, further analysis of audit items is needed to avoid repeated entry of audit items with the same semantics but different language expressions. Therefore, semantic analysis can be used to obtain existing audit items and The similarity of the audit items to be entered. If the similarity is less than the first similarity threshold, the audit item to be entered may have the same semantics as an existing audit item.
  • the audit item storage subsystem 100 may pre-judge the audit item to be entered as Audit items with the same semantics are provided to the system administrator or the current user for manual evaluation, based on the results of manual evaluation to determine whether to enter the audit item (as shown in Figure 3A), when the manual evaluation results determine the audit item and existing audit items When the semantics are different, the audit item is entered. For the same audit field, there may also be conflicts of audit items. Therefore, you can also determine whether the audit items to be entered conflict with existing audit items based on the similarity between the audit items. You need to submit a manual evaluation to determine how to deal with conflicting audit items.
  • audit item A and audit item B in the same audit area, if audit item A specifies that the data retention period is greater than 5 years, and audit item B specifies that the data retention period is less than 5 years, then audit item A and audit item B can be considered conflict.
  • the retained audit item can be determined based on the method of manual selection, the audit item to be entered is not entered, or the audit item to be entered is entered Audit items and delete existing audit items; when the results of manual evaluation determine that the audit items have different semantics and do not conflict with the existing audit items, the audit item to be entered is entered.
  • the above entry method avoids the repeated audits caused by the similarity of audit items, greatly reduces the cost and improves the audit efficiency.
  • the above semantic analysis can be used to obtain the similarity between the existing audit items and the audit items to be entered can be based on a set of preset semantic templates.
  • the semantic template set may be a set composed of multiple semantic templates, and each semantic template may be generated based on a certain standard or specification (such as an audit standard) and associated with at least one metadata. For an auditing domain, it can correspond to at least one semantic template set.
  • multiple standards organizations SD0 Standard Development Organization
  • develop and publish standards they can divide their published standards into multiple audit areas according to their relevance. For example, take the example shown in Figure 3B as an example.
  • the audit domain 1 corresponds to the semantic template set 1
  • SDO3, SDO4 and SDO5 belong to the audit domain 2
  • the audit domain 2 corresponds to the semantic template set 2.
  • Each semantic template can be stored in an address corresponding to the hash value of the semantic template, where the hash value of the semantic template can be the hash value of the metadata (megadata) associated with the semantic template (as shown in FIG. 3C) Shown Mh1 to Mhp).
  • the audit item to be entered can be matched with the semantic template in the semantic template set corresponding to the audit field according to the audit field to which the audit item to be entered belongs, based on the audit to be entered
  • the semantic template can be used for semantic analysis, and then the above similarity determination and other processes can be performed.
  • the hash value of the audit item to be entered can be correlated to the hash value of the matching semantic template, so that the audit items with the same or similar semantics are grouped into a set, thereby Diversity based on semantic templates is implemented.
  • the audit items associated with the hash value of the semantic template can form a data structure for storage or display (as shown in FIG. 3C).
  • a manual evaluation can also be submitted to determine the retention and deletion of audit items.
  • a new semantic template may be created, for example, by manual intervention.
  • the hash value of the audit item can be used for addressing and storage. Therefore, each audit item has a unique Hash value, therefore, it can be determined whether the entry can be directly performed by comparing the hash value of the audit item to be entered with the hash value of the existing audit item.
  • the target storage address may be determined based on the hash value of the audit item to be entered, and the audit item to be entered may be stored to the target storage address.
  • an audit area can include multiple audit objects, and when it is entered, it can also be entered for a specific audit object, for example, for a certain Audit objects, based on specifications or standards, enter multiple audit items associated with the audit object.
  • the audit item when the audit item is entered, it may also be a non-targeted entry, which is not specifically limited in the embodiments of the present application.
  • the audit item storage subsystem 100 when the audit item storage subsystem 100 stores the audit item, it can be stored in association with the audit object, so that the auditor can obtain the audit item stored in association with the audit object by calling the audit object during the audit
  • audit object 1 can be associated with multiple audit items A1, B1, C1, etc. by default.
  • the audit item storage subsystem 100 may not store the audit object and the audit item in association, which is not specifically limited in the embodiment of the present application.
  • the determination process between the audit item to be entered and the existing audit item in the audit field to which the audit item to be entered belongs can be implemented through a smart contract.
  • the on-site audit subsystem 101 is used for auditing.
  • the on-site audit subsystem 101 can be used to provide an audit interface for auditors to perform operations on site.
  • the on-site audit subsystem 101 includes an audit object subsystem.
  • the auditee enters one or more audit objects according to the audit template.
  • the storage subsystem 100 can be associated with each other based on the audit item.
  • the auditee provides evidence related to this audit item and the audit object. Based on the evidence provided, the audit party can choose to provide a compliance judgment score on site, or provide the compliance judgment score remotely to form The audit results of the audit items associated with the audit object. Among them, the auditee can provide relevant evidence through the audit object subsystem.
  • the on-site auditing subsystem 101 can store audit-related data of serviced business entities, for example, in the form of a database to facilitate the on-site or remote audits.
  • This form of local storage can avoid data leakage , To achieve the purpose of security and confidentiality.
  • the at least one electronic device 102 can be used as an audit client.
  • the electronic device can run an audit client and can be installed on any electronic device, such as a portable electronic device, such as a mobile phone or a tablet computer.
  • a portable electronic device such as a mobile phone or a tablet computer.
  • Such electronic equipment can, of course, also be specialized audit equipment.
  • the electronic device 102 may be configured with a trusted execution environment (TEE, trusted execution environment) or a trusted application (TA, trusted application) to store the user's private key and perform operations such as signature.
  • TEE trusted execution environment
  • TA trusted application
  • the audit system can generate a pair of keys for the user, including a public key and a private key, and the public key can be distributed to devices in the audit system , Used for signature verification and other steps, and the private key can be stored in the TEE or TA of the electronic device 102, so that when necessary, the electronic device and TEE or TA interact to perform signature and other steps, the private key is not Can be exported to TEE or TA, which greatly improves security.
  • the TEE or TA of the electronic device 102 may store the private key of the logged-in user, and when the user logs out, the private key may be retained or deleted.
  • the audit result data storage subsystem 103 is used to store audit result data.
  • the storage may be carried out in the form of a blockchain, that is, the audit result data storage subsystem 103 may include multiple node devices (as shown in FIG. 4), and each node may use devices to serve different business entities, respectively.
  • Chain storage means that the data stored on each node device cannot be tampered with.
  • each user needs to register, such as the auditee or the auditee, both the auditee and the auditee can register at least one account for their own audit participation Use by personnel.
  • the person to be audited needs to complete the registration first and select the name of the institution to which it belongs. If the relevant institution has not been registered, the institution registration needs to be further completed; The client obtains the corresponding public and private key pair (pk1, sk1); when using the audit client, the auditor needs to first complete the registration and select the audit institution to which it belongs. If the relevant audit institution has not been registered, the audit institution needs to be further completed Registration; and, after the registration of the auditors of an audit institution is completed, the audit client obtains the corresponding public and private key pair (pk2, sk2).
  • FIG. 5 is a flowchart of a method for storing audit result data according to an embodiment of the present application. Referring to FIG. 5, this embodiment relates to a first user as an auditee and a second user as an auditee.
  • the method for storing audit result data includes:
  • Auditors can operate in the on-site audit subsystem to input audit objects, and the on-site audit subsystem can establish a data connection with the audit item storage subsystem to obtain the audit object association from the audit item storage subsystem according to the audit object One or more audit items.
  • the one or more audit items may be the default related items of the audit object, and the auditor may adjust the default related items according to actual audit requirements (such as deleting a certain audit item, or adding a certain audit item), and The audit personnel may obtain one or more audit items from the audit item storage subsystem based on actual audit requirements, which is not limited in the embodiment of the present application.
  • the audit result of each audit item in the audit result data includes the hash value of the audit item, the hash value of the characteristic value of the first user, and the hash value of the audit evidence. Due to the irreversible hash value, the data transmission based on the hash value can ensure that the original audit data is not leaked.
  • the hash value Hash (L) of the audit item the hash value Hash (O) of the characteristic value of the audit object, and the hash value of the evidence provided by the auditee Hash (E).
  • the audit result of each audit item in the audit result data also includes the hash value of the audit context, the hash value of the characteristic value of the second user, the hash value of the second user information, and the hash value of the first user information At least one of the column values. That is, the audit items can also include the audit context hash value Hash (Con), the audit party's characteristic value hash value Hash (D), the audit party's basic information hash value Hash (A), the auditee's basic information The hash value Hash (O).
  • the audit items can also include the audit context hash value Hash (Con), the audit party's characteristic value hash value Hash (D), the audit party's basic information hash value Hash (A), the auditee's basic information The hash value Hash (O).
  • the first user information may be organization information or organization code of the first user
  • the second user information may be organization information or organization code of the second user
  • the user information may also include the user
  • the employee number and so on are not limited in the embodiments of the present application.
  • the audit context refers to information related to the audit, such as the location of the audit and the time when the audit occurred.
  • the foregoing audit may be performed by an auditor on the on-site audit subsystem, or may be performed by a remotely-accessed auditor, which is not limited in the embodiments of the present application.
  • the on-site audit subsystem displays a first graphical identification code according to the first hash value of the audit result data, and the first graphical identification code is used to represent the audit result data.
  • the on-site audit subsystem generates the first hash value of the audit result data based on the audit result data. Before generating the first hash value, each audit item in the audit result data may be combined to form a new data block, and then the hash processing is performed to obtain the first hash value.
  • the on-site audit subsystem then generates a first graphical identification code based on the first hash value and displays it on the screen of the on-site audit subsystem.
  • the first graphic identification code may be a two-dimensional code, such as a QR (Quick Response) code.
  • the first graphic identification code can also identify the second user who is the auditing party, so that in the subsequent process, other devices can be informed of the personnel performing the audit on site.
  • the first electronic device scans the first graphic identification code to obtain the first hash value represented by the first graphic identification code.
  • the first electronic device refers to a device logged in by the first user of the audited party, and the staff of the audited party can obtain the first hash value on the first electronic device for storage by using the code scanning method.
  • This data transmission method based on the graphic identification code not only has simple and convenient operation methods, but also greatly improves the intuitiveness and credibility of the entire transmission.
  • steps 503 and 504 are for data transmission through the scan code mode.
  • the scan code mode may not be used, but other data may be used.
  • the transmission method such as Bluetooth or local area network connection, is not limited in this embodiment of the present application.
  • the first electronic device sends the first hash value to the trusted execution environment of the first electronic device.
  • the signature may be based on authorization, that is, when the first user approves the audit result data, the first electronic device may be authorized to sign the audit result data to indicate that the audited party approves the Audit results. When the first user does not approve the audit result data, the signature may not be authorized.
  • the first user's private key is stored in the trusted execution environment of the first electronic device.
  • the first electronic device may send the first hash value to the trusted execution environment for signature instead of obtaining the private key Sign yourself.
  • the first electronic device may send a signature instruction to the trusted execution environment, where the signature instruction carries the client identifier and the first hash value to identify which private key needs to be used for the hash value Sign.
  • the trusted execution environment signs the first hash value according to the first user's private key, obtains first signature data, and sends the first signature data to the first electronic device.
  • the trusted execution environment may obtain the private key of the first user, and then use the private key to sign the first hash value.
  • the trusted execution environment may verify the client ID carried by the signature instruction, and when the trusted client ID includes the client ID, obtain the private key corresponding to the client ID, Execute the signed instruction.
  • the first electronic device After receiving the first signature data, the first electronic device sends the first signature data to the audit result data storage subsystem.
  • the audit result data storage subsystem is used to store the audit result data.
  • the audit result data storage subsystem is used to store data in the form of a blockchain.
  • the first electronic device may send the first signed data to the audit result data storage subsystem to determine that the auditee has approved the audit result.
  • the audit result data storage subsystem After receiving the first signature data, the audit result data storage subsystem sends a first certificate of proof to the second electronic device.
  • the first certificate of proof is used to indicate that the first signature data has been stored in the audit result data storage subsystem .
  • the audit result data storage subsystem may also return the first certificate of deposit to the first electronic device to inform the first electronic device that the storage is complete.
  • the audit result data storage subsystem may also return a progress statement to the first electronic device to inform the first electronic device that the signature at the current stage has been completed, and the signature of the second user is required to complete the data storage.
  • the audit result data storage subsystem may verify the first signature data. The verification may be performed based on the public key of the first user. When the verification is passed, perform step 508 1. The sending steps and follow-up process of certificate of deposit.
  • the second electronic device receives the first certificate of deposit, it obtains the first signature data from the audit result data storage subsystem.
  • the first signature data obtained from the audit result data storage subsystem may be the first signature data sent by the audit result data storage subsystem, or the second electronic device may actively store the audit result data
  • the first signature data corresponding to the first certificate of deposit is obtained from the subsystem, which is not limited in this embodiment of the present application.
  • the second electronic device sends the first signature data to the trusted execution environment of the second electronic device.
  • the trusted execution environment signs the first signature data according to the second user's private key, obtains the second signature data, and sends the second signature data to the second electronic device.
  • the second electronic device After receiving the second signature data, the second electronic device sends the second signature data to the audit result data storage subsystem.
  • the audit result data storage subsystem is used to store data in the form of a blockchain.
  • Steps 510 to 512 are the same as the process of signing and sending the first electronic device.
  • the audit result data storage subsystem stores the second signature data.
  • the second signature data is the data signed by the first user and the second user, and the double signatures of the auditing party and the audited party are obtained, which can greatly improve the security of the data, and store the audit by adopting the form of a blockchain
  • the result data can prevent the leakage of data while ensuring the authenticity of the audit results.
  • the audit result data storage subsystem sends a second certificate of proof to the second electronic device.
  • the second certificate of proof is used to indicate that the second signature data has been stored in the audit result data storage subsystem.
  • the audit result data storage subsystem may also return a second certificate of deposit to the first electronic device to inform the first electronic device that the storage is complete.
  • the audit results are formed on the on-site audit subsystem
  • the QR code B0 corresponding to the data a the auditee can log in on the audit client 601 and choose to use the scan code mode, scan B0, collect the audit result a to the audit client, and authorize the signature of the audit result a. It can be realized by the TEE of the audit client.
  • the first signature data obtained by the TEE using the private key sk1 can be expressed as Sign (a), and the Sign (a) is sent to the audit result data storage subsystem.
  • the storage subsystem sends Sign (a) to the audit client 602 where the second user logs in, and the second user authorizes the signing of Sign (a) on the audit client 602 to obtain Sign (b), and sign ( b) Send to the audit result data storage subsystem for storage.
  • the above storage method by not passing the actual audit result data, but storing the hash value of the audit result data in a multi-party signature method, is stored in the audit result data storage subsystem, which greatly reduces the possibility of data leakage, It can provide security for sensitive information.
  • FIG. 5 is an example in which the first user and the second user perform signatures based on the data transfer of the audit result data storage subsystem, and in the embodiment shown in FIG. 7, a The first user and the second user perform data transfer based on the graphic identification code, and take signature as an example to describe the process.
  • this embodiment specifically includes:
  • the on-site audit subsystem displays a first graphical identification code according to the first hash value of the audit result data, and the first graphical identification code is used to represent the audit result data.
  • the first electronic device scans the first graphic identification code to obtain the first hash value represented by the first graphic identification code.
  • the first electronic device sends the first hash value to the trusted execution environment of the first electronic device.
  • the trusted execution environment signs the first hash value according to the first user's private key, obtains first signature data, and sends the first signature data to the first electronic device.
  • steps 701 to 706 are the same as steps 501 to 506.
  • the first electronic device After receiving the first signature data, the first electronic device displays a second graphic identification code, and the second graphic identification code is used to represent the first signature data.
  • the staff of the audited party can select the code scanning mode on the first electronic device, so that the staff of the audited party can obtain the first signature data by scanning the code in a face-to-face manner, and the operation is simple and intuitive.
  • the second electronic device scans the second graphic identification code to obtain the first signature data represented by the second graphic identification code.
  • the second electronic device refers to a device logged in by a second user of the auditing party, and the staff of the auditing party can obtain the first signature data on the second electronic device for storage by using the code scanning method.
  • This data transmission method based on the graphic identification code not only has simple and convenient operation methods, but also greatly improves the intuitiveness and credibility of the entire transmission.
  • the second electronic device sends the first signature data to the trusted execution environment of the second electronic device.
  • the trusted execution environment signs the first signature data according to the second user's private key, obtains the second signature data, and sends the second signature data to the second electronic device.
  • the second electronic device After receiving the second signature data, the second electronic device sends the second signature data to the audit result data storage subsystem.
  • the audit result data storage subsystem is used to store the audit result data.
  • the audit result data storage subsystem stores the second signature data.
  • the audit result data storage subsystem sends a second certificate of proof to the second electronic device.
  • the second certificate of proof is used to indicate that the second signature data has been stored in the audit result data storage subsystem.
  • Steps 709 to 713 are the same as steps 510 to 514.
  • the audit results are formed on the on-site audit subsystem
  • the QR code B0 corresponding to the data a the auditee can log in on the audit client 801 and choose to use the scan code mode, scan B0, collect the audit result a to the audit client 801, and authorize the signature of the audit result a It can be realized by the TEE of the audit client.
  • the first signed data obtained by the TEE using the above private key sk1 can be expressed as Sign (a).
  • the audit client forms the same as Sign (a) Corresponding two-dimensional code B1, in the audit client, the audit party can be associated with the auditee.
  • the audit party can choose to use the scan code mode to collect the Sign (a) data corresponding to the audit result B1 to the audit client 802.
  • the two users authorize the signing of Sign (a) on the audit client 802 to obtain Sign (b), and send Sign (b) to the audit result data storage subsystem for storage.
  • the above storage method by not passing the actual audit result data, but storing the hash value of the audit result data in a multi-party signature method, is stored in the audit result data storage subsystem, which greatly reduces the possibility of data leakage, It can provide security for sensitive information.
  • data can be stored in the form of a blockchain.
  • the storage process will be described below as shown in FIG. 9, and this process can be applied to the process of FIG. 5 or FIG. 7 described above.
  • Any node device in the audit result data storage subsystem receives the second signature data sent by the second electronic device.
  • the second signature data is used to represent the first user who is the auditee and the second user who is the auditee.
  • the first hash value is used to represent the audit result data of the first user.
  • the node device verifies the second signature data. When the verification is passed, the second signature data is broadcast in the audit result data storage subsystem.
  • step 902 may specifically include: based on the public key of the first user and the public key of the second user Two signature data for verification.
  • the verification may include decrypting the second signature data using the public key of the second user and the public key of the first user to obtain the first hash value, if the decryption is successful, the verification is passed, if the decryption is not successful, then Verification failed.
  • the node device stores the second signature data in the blockchain of the audit result data storage subsystem.
  • any node device it can receive the second signature data broadcasted by the node device in step 902, and verify the second signature data.
  • the node device can broadcast the verification passed message, and each node device can Based on the received verification pass message, it is determined whether the second signature data has passed consensus, which is not limited in the embodiment of the present application.
  • consensus process is only an exemplary illustration.
  • the data itself can be secured while preventing the data from being tampered with, and the efficiency of the query can be improved due to the higher data processing efficiency of the blockchain itself.
  • the second signature data may be stored in association with the stored data of the first user in the blockchain to facilitate querying.
  • any of the following methods may be used:
  • the hash value corresponding to the audited party included in the second signature data may be used to obtain the audited party's stored in the blockchain
  • a new block is generated, and the historical audit situation of the audited party is recorded in the new block in a Merkel tree manner. This way of storing in blocks can be performed every time the second signature data is received.
  • each node device may maintain a corresponding Merkel tree for each first user, and update the Merkel tree corresponding to each first user based on signature data passed by consensus. This process may be performed every time the second signature data is received, or may be performed when the block height reaches a certain value, which is not limited in the embodiments of the present application.
  • the storage of the above Merkel tree may be implemented by a container.
  • C1 to Cn For the n audits in 2017, they are denoted as C1 to Cn.
  • the audit result data storage subsystem generates a query page of the third user based on the data corresponding to the third user in the audit result data storage subsystem,
  • the third user's query page includes the third user's audit results.
  • the data corresponding to the third user includes the historical audit result of the third user, because after each audit of the third user, the signature data representing the audit result of the third user is stored in the audit result data storage Subsystem, and the storage method is used for each storage, so that the data obtained by each audit of the third user is related. Therefore, when generating the query page of the third user, you can use the signature data The relationship between time to generate the audit results related to time.
  • the audit results of the third user include audit result items divided by at least one of year, half year, quarter, and month.
  • the query page may include audit result items in units of years, and each audit result item in units of years is also mounted with audit result items in units of quarters, etc. This is not limited in the embodiments of the present application.
  • the inquirer can view based on any audit result item, and click on the audit result item to trigger a viewing instruction to jump to the information page of the audit result item, etc. This embodiment of the present application does not limit this .
  • the above display of the query page may be implemented based on the graphic identification code, that is, when the audit result data storage subsystem receives the page query request, it may be based on the hash of the characteristic value of the audited user carried in the page query request
  • the information such as the value is used as the query index to provide the page link address of the query page in the form of a graphic identification code, and when the queryer accesses the page link address, the query page can be displayed on the access device.
  • the query process may also be based on a query index other than the hash value of the characteristic value of the audited user. For example, it may be based on the hash value of the characteristic value of the audit party, or, based on the audit context information.
  • the hash value and the like are not limited in the embodiments of the present application.
  • the third electronic device can obtain the page link address of the query page of the third user by scanning the third graphic identification code provided by any electronic device; send a webpage access request, and the webpage access request is used for access
  • the audit results of the third user include audit result items divided by at least one of year, half year, quarter or month. After displaying the query page of the third user, when receiving a viewing instruction for any audit result item, the audit result data corresponding to the audit result item is obtained.
  • correlating a user with the historical audit results conducted by the user can not only greatly improve the efficiency of the query, but also make the data more standardized. Further, by providing the link address of the query page in the form of a graphic identification code, intuitive and convenient query can also be achieved.
  • steps in the embodiments of the present application are not necessarily executed in the order indicated by the step numbers. Unless clearly stated in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in each embodiment may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed and completed at the same time, but may be executed at different times. The order is not necessarily sequential, but may be executed in turn or alternately with at least a part of other steps or sub-steps or stages of other steps.
  • FIG. 11 is a schematic structural diagram of an audit result data storage device provided by an embodiment of the present application.
  • the device is applied to the first electronic equipment, and the device includes:
  • a hash obtaining module 1101, configured to obtain the first hash value of the audit result data of the first user
  • the signature module 1102 is used to sign the first hash value according to the first user's private key to obtain the first signature data;
  • the sending module 1103 is used to send the first signature data to the audit result data storage subsystem, and the audit result data storage subsystem is used to store data in the form of a blockchain.
  • the hash obtaining module 1101 is configured to obtain the first hash value represented by the first graphic identification code by scanning the first graphic identification code provided by any electronic device.
  • the audit result of each audit item in the audit result data includes the hash value of the audit item, the hash value of the characteristic value of the first user, and the hash value of the audit evidence.
  • the audit result of each audit item in the audit result data further includes the hash value of the audit context, the hash value of the characteristic value of the second user, the hash value of the second user information, and the first At least one of the hash values of user information.
  • the signature module is used to:
  • the first signature data is obtained by the trusted execution environment of the first electronic device by signing the first hash value according to the first user's private key.
  • the first user's private key is generated by the audit system at the first user. Generated after successful registration.
  • the device further includes:
  • the display module is configured to display a second graphic identification code according to the first signature data, and the second graphic identification code is used to represent the first signature data.
  • the audit result data storage device stores the audit result data
  • only the above-mentioned division of each functional module is used as an example for illustration.
  • the above-mentioned functions can be assigned to different functions as needed
  • Module completion means dividing the internal structure of the device into different functional modules to complete all or part of the functions described above.
  • the embodiments of the audit result data storage method provided by the above embodiments belong to the same concept, and the specific implementation process thereof can be seen in the method embodiments.
  • FIG. 12 is a schematic structural diagram of an audit result data storage device provided by an embodiment of the present application.
  • the device is applied to the second electronic equipment, and the device includes:
  • the obtaining module 1201 is used to obtain first signature data, and the first signature data is used to represent the audit result data of the first user;
  • the signature module 1202 is used to sign the first signature data according to the private key of the second user to obtain the second signature data;
  • the sending module 1203 is configured to send the second signature data to the audit result data storage subsystem.
  • the audit result data storage subsystem is used to store data in the form of a blockchain.
  • the signature module is used to:
  • the second signature data is obtained by the trusted execution environment of the second electronic device according to the private key of the second user to sign the first signature data.
  • the private key of the second user is registered with the second user by the audit system Generated after success.
  • the obtaining module is configured to obtain the first signature data represented by the second graphic identification code by scanning the second graphic identification code provided by the first electronic device.
  • the obtaining module is configured to receive a first certificate of proof of the audit result data storage subsystem, and the first certificate of proof is used to indicate that the first signature data has been stored in the audit result data storage subsystem; and, Obtain the first signature data from the audit result data storage subsystem.
  • the device further includes:
  • the receiving module is used to receive a second certificate of proof of the audit result data storage subsystem, and the second certificate of proof is used to indicate that the second signature data has been stored in the audit result data storage subsystem.
  • the audit result data storage device stores the audit result data
  • only the above-mentioned division of each functional module is used as an example for illustration.
  • the above-mentioned functions can be assigned to different functions as needed.
  • Module completion means dividing the internal structure of the device into different functional modules to complete all or part of the functions described above.
  • the embodiments of the audit result data storage method provided by the above embodiments belong to the same concept, and the specific implementation process thereof can be seen in the method embodiments.
  • FIG. 13 is a schematic structural diagram of an audit result data storage device provided by an embodiment of the present application.
  • the device is applied to any node device in the audit result data storage subsystem, and multiple node devices in the audit result data storage subsystem are equipped with a consensus mechanism, including:
  • the receiving module 1301 is configured to receive second signature data sent by a second electronic device, and the second signature data is used to represent a first hash value signed by the first user as the audited party and the second user as the auditing party, The first hash value is used to represent the audit result data of the first user;
  • the verification module 1302 is used to verify the second signature data
  • the sending module 1303 is configured to broadcast the second signature data in the audit result data storage subsystem when the verification is passed;
  • the storage module 1304 is configured to store the second signature data in the audit result data storage subsystem when the audit result data storage subsystem passes consensus on the second signature data.
  • the verification module is configured to verify the second signature data based on the public key of the first user and the public key of the second user.
  • the storage module is used to associate and store the second signature data with the stored data of the first user in the blockchain.
  • the device further includes:
  • the page generation module is used to generate a query page of the third user based on the data corresponding to the third user in the audit result data storage subsystem, and the query page of the third user includes the audit result of the third user.
  • the device further includes:
  • the address providing module is used to provide the page link address of the query page of the third user in the form of a graphic identification code.
  • the receiving module is further configured to receive the first signature data sent by the first electronic device, and send the first certificate of proof to the second electronic device according to the first signature data.
  • the first certificate of proof is used to Indicates that the first signature data has been stored in the audit result data storage subsystem.
  • the sending module is further configured to send a second certificate of proof to the second electronic device, where the second certificate of proof is used to indicate that the second signature data has been stored in the audit result data storage subsystem.
  • the audit result data storage device stores the audit result data
  • only the above-mentioned division of each functional module is used as an example for illustration.
  • the above-mentioned functions can be assigned to different functions as needed.
  • Module completion means dividing the internal structure of the device into different functional modules to complete all or part of the functions described above.
  • the embodiments of the audit result data storage method provided by the above embodiments belong to the same concept, and the specific implementation process thereof can be seen in the method embodiments.
  • FIG. 14 is a schematic structural diagram of an audit result data query device provided by an embodiment of the present application. Referring to FIG. 14, the device includes:
  • the address obtaining module 1401 is configured to obtain the page link address of the query page of the third user by scanning the third graphic identification code provided by any electronic device;
  • the sending module 1402 is used to send a webpage access request, and the webpage access request is used to access the page link address of the query page of the third user;
  • the display module 1403 is used to display a query page of the third user, and the query page includes the audit result of the third user.
  • the audit results of the third user include audit result items divided by at least one of year, half year, quarter, and month.
  • the device further includes:
  • the data acquisition module is used for acquiring audit result data corresponding to the audit result item when receiving the viewing instruction for any audit result item.
  • the audit result data query device provided in the above embodiments only uses the division of the above functional modules as an example to illustrate the audit result data query.
  • the above functions can be allocated by different functions as needed
  • Module completion means dividing the internal structure of the device into different functional modules to complete all or part of the functions described above.
  • the embodiments of the audit result data query method provided by the above embodiments belong to the same concept, and the specific implementation process thereof can be seen in the method embodiments.
  • FIG. 15 is a schematic structural diagram of an audit item storage device provided by an embodiment of the present application. Referring to FIG. 15, the device further includes:
  • Audit item entry module 1501 used to obtain audit items to be entered
  • the hash obtaining module 1502 is used to obtain the second hash value of the audit item to be entered;
  • the query module 1503 is configured to query the hash value of the existing audit item in the audit field to which the audit item to be entered belongs according to the second hash value;
  • the storage module 1504 is configured to not store the audit item to be entered when the hash value of the existing audit item includes the same hash value as the second hash value.
  • the storage module is also used if the hash value of the existing audit item does not include the same hash value as the second hash value, and the existing audit item includes the same as the audit item to be entered. Audit items whose similarity is greater than the first similarity threshold are stored as audit items to be entered.
  • the storage module is also used if the hash value of the existing audit item does not include the same hash value as the second hash value, and the existing audit item in the same audit area includes If the similarity of the audit items to be entered is less than the first similarity threshold, determine whether to store the audit items to be entered according to the results of manual evaluation.
  • the device is applied to an audit item storage system, and the audit item storage system is used to store each audit item in the form of a blockchain.
  • the audit item storage device provided in the above embodiment stores audit items
  • only the above-mentioned division of each functional module is used as an example for illustration.
  • the above-mentioned functions may be allocated by different functional modules according to needs That is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.
  • the embodiments of the audit item storage method provided by the above embodiments belong to the same concept, and the specific implementation process thereof can be seen in the method embodiments.
  • the audit system includes: an audit item storage subsystem, an on-site audit subsystem, at least one electronic device, and an audit result data storage subsystem;
  • the audit item storage subsystem is used to store multiple audit items
  • the on-site audit subsystem is used to interact with the audit item storage subsystem to provide the first user's audit page, obtain the first user's audit result data, and provide the first user's audit result for the first electronic device in at least one electronic device
  • the first electronic device is used to sign the first hash value according to the private key of the first user to obtain the first signature data
  • the second electronic device is used to sign the first signature data according to the second user's private key, obtain the second signature data, and send the second signature data to the audit result data storage subsystem;
  • the audit result data storage subsystem is used to store the second signature data in the form of a blockchain.
  • the electronic device 1600 may have a relatively large difference due to different configurations or performance, and may include one or more than one processor (central processing units (CPU) 1601 And one or more memories 1602, where at least one instruction is stored in the memory 1602, and the at least one instruction is loaded and executed by the processor 1601 to implement the methods provided by the foregoing method embodiments.
  • processor central processing units
  • memories 1602 where at least one instruction is stored in the memory 1602, and the at least one instruction is loaded and executed by the processor 1601 to implement the methods provided by the foregoing method embodiments.
  • the electronic device may also have components such as a wired or wireless network interface, a keyboard, and an input-output interface for input and output.
  • the electronic device may also include other components for implementing device functions.
  • a computer-readable storage medium is also provided, for example, a memory including instructions that can be executed by a processor in the terminal to complete the audit result data storage method or query method or audit in the foregoing embodiments Item storage method and other methods provided by the above method embodiments.
  • the computer-readable storage medium may be read-only memory (Read-Only Memory, ROM), random-access memory (Random Access Memory, RAM), read-only compact disc (Compact Disc Read-Only Memory, CD-ROM), Magnetic tapes, floppy disks, optical data storage devices, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Power Engineering (AREA)
  • Data Mining & Analysis (AREA)
  • Storage Device Security (AREA)

Abstract

一种审计结果数据存储、查询方法、审计项存储方法及装置和电子设备及介质，所述方法包括：获取第一用户的审计结果数据的第一散列值；根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；及，将所述第一签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。

Description

审计结果数据存储、查询方法、审计项存储方法及装置
本申请要求于2018年10月10日提交中国专利局，申请号为201811179316.6，申请名称为“审计结果数据存储、查询方法、审计项存储方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据存储领域，特别涉及一种审计结果数据存储、查询方法、审计项存储方法及装置。
背景技术
审计是指由专设机关依照法律对国家各级政府及金融机构、企业事业组织的重大项目和财务收支进行事前和事后的审查的独立性监督活动，当然，该审计还可以是指对一些网络安全性方面的审计。审计作为一种监督机制，其实践活动历史悠久，然而，目前的审计方式，一般是各个审计机构对被审计单位提交的资料进行人工审计，涉及到大量的纸质材料的传递，而这种材料的传递，不仅不环保，而且更加不利于数据的存储和保密。
发明内容
根据本申请提供的各种实施例，提供了一种审计结果数据存储、查询方法、审计项存储方法及装置。
一种审计结果数据存储方法，由第一电子设备执行，包括：
获取第一用户的审计结果数据的第一散列值；
根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；及
将所述第一签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
一种审计结果数据存储方法，由第二电子设备执行，包括：
获取第一签名数据，所述第一签名数据用于表示第一用户的审计结果数据；
根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据；及
将所述第二签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
一种审计结果数据存储方法，由审计结果数据存储子系统中的任一节点设备执行，所述审计结果数据存储子系统中的多个节点设备配置有共识机制，包括：
接收第二电子设备发送的第二签名数据，所述第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，所述第一散列值用于表示所述第一用户的审计结果数据；
对所述第二签名数据进行验证；
当验证通过时，在审计结果数据存储子系统中广播所述第二签名数据；及
当所述审计结果数据存储子系统对所述第二签名数据共识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
一种审计结果数据查询方法，由第三电子设备执行，包括：
通过扫描任一电子设备提供的第三图形标识码，得到第三用户的查询页面的页面链接地址；
发送网页访问请求，所述网页访问请求用于访问所述第三用户的查询页面的页面链接地址；及
显示所述第三用户的查询页面，所述查询页面中包括所述第三用户的审计结果。
一种审计项存储方法，由审计项存储子系统执行，包括：
获取待录入的审计项；
获取所述待录入的审计项的第二散列值；
根据所述第二散列值，在所述待录入的审计项所属审计领域的已有审计项的散列值中进行查询；及
当所述已有审计项的散列值包括与所述第二散列值相同的散列值，不存储所述待录入的审计项。
一种审计结果数据存储装置，包括：
散列获取模块，用于获取第一用户的审计结果数据的第一散列值；
签名模块，用于根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；及
发送模块，用于将所述第一签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
一种审计结果数据存储装置，包括：
接收模块，用于接收第二电子设备发送的第二签名数据，所述第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，所述第一散列值用于表示所述第一用户的审计结果数据；
验证模块，用于对所述第二签名数据进行验证；
发送模块，用于当验证通过时，在审计结果数据存储子系统中广播所述第二签名数据；及
存储模块，用于当所述审计结果数据存储子系统对所述第二签名数据共识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
一种审计结果数据查询装置，包括：
地址获取模块，用于通过扫描任一电子设备提供的第三图形标识码，得到第三用户的查询页面的页面链接地址；
发送模块，用于发送网页访问请求，所述网页访问请求用于访问所述第三用户的查询页面的页面链接地址；及
显示模块，用于显示所述第三用户的查询页面，所述查询页面中包括所述第三用户的审计结果。
一种审计项存储装置，包括：
审计项录入模块，用于获取待录入的审计项；
散列获取模块，用于获取所述待录入的审计项的第二散列值；
查询模块，用于根据所述第二散列值，在所述待录入的审计项所属审计领域的已有审计项的散列值中进行查询；及
存储模块，用于当所述已有审计项的散列值包括与所述第二散列值相同的散列值，不存 储所述待录入的审计项。
一种审计结果数据存储方法，包括：
第一电子设备获取第一用户的审计结果数据的第一散列值，根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；
第二电子设备在获取到所述第一签名数据后，根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据，将所述第二签名数据发送至审计结果数据存储子系统；及
所述审计结果数据存储子系统接收到所述第二签名数据后，如果对所述第二签名数据共识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
一种审计系统，所述审计系统包括：审计项存储子系统、现场审计子系统、至少一个电子设备以及审计结果数据存储子系统；
所述审计项存储子系统用于存储多个审计项；
所述现场审计子系统用于与所述审计项存储子系统交互，以提供第一用户的审计页面，得到所述第一用户的审计结果数据，为所述至少一个电子设备中的第一电子设备提供所述第一用户的审计结果数据的第一散列值；
所述第一电子设备用于根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；
所述第二电子设备用于根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据，将所述第二签名数据发送至所述审计结果数据存储子系统；及
所述审计结果数据存储子系统用于采用区块链的形式存储所述第二签名数据。
一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行上述审计结果数据存储方法的步骤。
一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行上述审计结果数据查询方法的步骤。
一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行上述审计项存储方法的步骤。
一种计算机可读存储介质，存储有计算机程序，所述计算机程序被一个或多个处理器执行时，使得一个或多个处理器执行上述任一方法的步骤。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征、目的和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种审计系统的系统架构图；
图2是本申请实施例提供的一种审计项录入所涉及的功能构成图；
图3A是本申请实施例提供的一种审计项录入流程的示意图；
图3B是本申请实施例提供的一种审计领域以及语义模板之间关系的示意图；
图3C是本申请实施例提供的一种语义模板基于元数据的特征值存储的示意图；
图4是本申请实施例提供的审计结果数据存储子系统103的结构示意图；
图5是本申请实施例提供的一种审计结果数据存储方法的流程图；
图6是本申请实施例提供的一种审计结果数据存储方法的示例的流程图；
图7是本申请实施例提供的一种审计结果数据存储方法的流程图；
图8是本申请实施例提供的一种审计结果数据存储方法的示例的流程图；
图9是本申请实施例提供的一种审计结果数据存储方法的流程图；
图10是本申请实施例提供的一种merkel树的示例图；
图11是本申请实施例提供的一种审计结果数据存储装置的结构示意图；
图12是本申请实施例提供的一种审计结果数据存储装置的结构示意图；
图13是本申请实施例提供的一种审计结果数据存储装置的结构示意图；
图14是本申请实施例提供的一种审计结果数据查询装置的结构示意图；
图15是本申请实施例提供的一种审计项存储装置的结构示意图；及
图16是本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
图1是本申请实施例提供的一种审计系统的系统架构图。参见图1，该审计系统包括审计项存储子系统100、现场审计子系统101、至少一个电子设备102以及审计结果数据存储子系统103。
该审计项存储子系统100用于存储审计项，所存储的审计项可以是由系统管理人员事先配置或是由系统内的用户上传。现场审计子系统101可以与审计项存储子系统100建立数据连接，现场审计子系统101可以获取审计人员输入的审计对象，可以根据获取到的审计对象，从审计项存储子系统100中获取与该审计对象关联的审计项。审计人员可以对现场审计子系统101上与该审计对象关联的审计项进行审计得到审计结果数据，现场审计子系统101可以基于该审计结果数据，生成该审计结果数据的第一散列值，现场审计子系统再基于该第一散列值，生成第一图形标识码，并显示于该现场审计子系统101的屏幕上。第一电子设备可以扫描第一图形标识码，得到该第一图形标识码对应的第一散列值，将该第一散列值发送至对应的可信执行环境，该可信执行环境可以根据第一电子设备的用户的私钥对该第一散列值，进行签名，得到第一签名数据，将该第一签名数据发送给该第一电子设备。第一电子设备接收到该第一签名数据后，将该第一签名数据发送至审计结果数据存储子系统103。审计结果数据存储子系统103在接收到该第一签名数据后，向第二电子设备发送第一存证证明。当第二电子设备接收到该第一存证证明时，从审计结果数据存储子系统103中获取第一签名数据，第二电子设备将第一签名数据发送至第二电子设备的可信执行环境中，第二电子设备的可信执行环境根据第二电子设备的用户的私钥对第一签名数据进行签名，得到第二签名数据，将该第二签名数据发送至该第二电子设备。第二电子设备接收第二签名数据后，将第二签名数据发送至审计结果数据存储子系统103，审计结果数据存储子系统103用于采用区块链的形式存储数据。
在一种可能实施方式中，该审计项存储子系统100可以包括服务器和多个用户侧设备，用户可以通过用户侧设备来将审计项上传至服务器，以实现集中存储。在一种可能实施方式 中，该审计项存储子系统100可以是去中心化的形式，也即是，审计项存储子系统100包括多个节点设备，各个节点设备配置有同一条区块链，来存储该多个节点设备共识通过的审计项，来实现去中心化的数据存储，以提高数据的安全性。以这种采用区块链形式进行审计项存储的系统架构为例，在对审计项存储时，可以包括散列处理、第一级判定(一致性判定)、语义处理、第二级判定(相似度判定)以及第三级判定(人工评测)的流程步骤(如图2所示)。具体地，上述流程包括：获取待录入的审计项；获取待录入的审计项的第二散列值；根据第二散列值，在待录入的审计项所属审计领域的已有审计项的散列值中进行查询；当已有审计项的散列值包括与第二散列值相同的散列值，不存储待录入的审计项。在这种存储方式下，由于相同的数据具有相同的散列值，因此，基于这种散列值的查询和比较，对于同一个审计领域来说，实现了不重复录入相同或相似度极大的审计项的目的，使得系统的存储负担降低，且审计项的冗余程度会大大降低。在一种可能实施方式中，如果待录入的审计项所属审计领域的已有审计项的散列值中不包括与第二散列值相同的散列值，当已有审计项中包括与待录入的审计项的相似度大于第一相似度阈值的审计项时，则判定待录入审计项为重复项，不存储待录入的审计项；当已有审计项中包括与待录入的审计项的相似度小于第二相似度阈值的审计项时，则可以将该待录入的审计项录入审计项中；及，当已有审计项中包括与待录入的审计项的相似度小于第一相似度阈值的审计项，根据人工评测结果确定是否存储待录入的审计项。其中，该相似度可以是基于语义分析所确定的相似度。对于没有相同的散列值的情况下，还需要对审计项进行进一步的分析，以避免将语义相同但是语言表达不同的审计项重复录入，因此，可以通过语义分析，来获取已有审计项与待录入的审计项的相似度。如果相似度小于第一相似度阈值，则可能该待录入的审计项与某个已有审计项是语义相同的，因此，审计项存储子系统100可以将该待录入的审计项和预判为语义相同的审计项提供给系统管理员或者当前用户，进行人工评测，基于人工评测结果来确定是否录入该审计项(如图3A所示)，当人工评测结果确定该审计项与已有审计项语义不同时，则录入该审计项。而对于同一个审计领域来说，还可能出现审计项冲突的情况，因此，还可以基于审计项之间的相似度来确定待录入的审计项是否与已有审计项有冲突，一旦有冲突，则需要提交人工评测来确定如何对冲突的审计项进行处理。对于同一个审计领域中的审计项A和审计项B，若审计项A规定数据的保存年限大于5年，审计项B规定数据的保存年限小于5年，则可以认为审计项A与审计项B冲突。参照图3A，当人工评测结果确定该审计项与已有审计项冲突时，则可以基于人工选择的方式，来确定保留的审计项，不录入该待录入的审计项，或者录入该待录入的审计项而删除已有的审计项；当人工评测结果确定该审计项与已有审计项语义不同且不冲突时，则录入该待录入的审计项。上述录入方法，避免了审计项雷同造成的重复审计，大大降低了成本，提高了审计效率。
需要说明的一点是，上述通过语义分析，来获取已有审计项与待录入的审计项的相似度可以基于预先设置的语义模板集合进行。其中，语义模板集合可以是多个语义模板所组成的集合，每个语义模板可以是基于某种标准或规范(例如审计标准)生成，并关联有至少一个元数据。对于一个审计领域(Auditing domain)来说，可以对应于至少一个语义模板集合。多个标准化组织SD0(Standard Development Organization)在制定和发布标准时，可以根据其相关性，将其所发布的标准划分为多个审计领域，例如，以图3B所示为例进行说明，SDO1和SDO2属于审计领域1,该审计领域1对应于语义模板集合1，SDO3、SDO4和SDO5属于审计领域2,该审计领域2对应于语义模板集合2。其中，各个语义模板可以存储在与语义模板的 散列值对应的地址中，其中，该语义模板的散列值可以是该语义模板关联的元数据(megadata)的散列值(如图3C所示的Mh1至Mhp)。
在审计项存储子系统中，可以根据待录入的审计项所属的审计领域，来将该待录入的审计项与该审计领域对应的语义模板集合中的语义模板进行匹配，当基于待录入的审计项匹配到对应的语义模板，也即是确定了匹配的语义模板集合时，则可以利用匹配到的语义模板进行语义分析，进而进行上述相似度的确定等过程。进一步地，通过审计项与语义模板的匹配，待录入的审计项的散列值可以关联至匹配的语义模板的散列值，以便将具有相同或相似语义的审计项分到一个集合中，从而实现了基于语义模板的分集，与语义模版的散列值关联的审计项可以构成存储或者显示的数据结构(如图3C所示)，还可以提交人工评测来确定审计项的保留和删除。进一步地，当基于待录入的审计项未匹配到对应的语义模板时，则可以创建新的语义模板，例如采用人工介入的方式来创建。
以该审计项存储子系统采用IPFS(星际文件系统，interplanetary file system)系统为例，在IPFS系统中，可以基于审计项的散列值进行寻址和存储，因此，各个审计项均具有唯一的散列值，因此，可以通过比较该待录入的审计项的散列值和已有审计项的散列值，来确定是否可以直接进行录入。当确定对该待录入的审计项进行录入时，可以基于该待录入的审计项的散列值，来确定目标存储地址，并将该待录入的审计项存储至目标存储地址。
需要说明的是，在进行审计项录入时，不仅可以是针对审计领域的录入，一个审计领域可以包括多个审计对象，在录入时，还可以是针对特定审计对象的录入，例如，对于某个审计对象，基于规范或者标准，录入多个与该审计对象关联的审计项。当然，在进行审计项录入时，也可以是不具有针对性的录入，本申请实施例对此不做具体限定。可选地，该审计项存储子系统100在存储审计项时，可以与审计对象进行关联存储，使得审计人员在进行审计时，可以通过调取审计对象，来获取与审计对象关联存储的审计项，达到提高处理效率的目的，例如，对于审计对象1可以默认关联有多个审计项A1、B1和C1等等。当然，审计项存储子系统100也可以不对审计对象和审计项进行关联存储，本申请实施例对此也不做具体限定。
需要说明的是，上述对待录入的审计项与待录入的审计项所属审计领域的已有审计项之间的判定过程可以通过智能合约实现。
现场审计子系统101用于进行审计。该现场审计子系统101可以用于提供审计界面，以供审计人员在现场进行操作。该现场审计子系统101包括审计对象子系统，在审计对象子系统中，由被审计方依照审计模版输入一个或者多个审计对象，对于每个审计对象，可基于审计项存储子系统100关联相关一个或者多个审计项，被审计方提供与此审计项和审计对象关联的证据，审计方基于所提供的证据，可选择在现场提供符合度判定分数，或者通过远程提供符合度判定分数，形成针对该审计对象的关联的各个审计项的审计结果。其中，被审计方可以通过审计对象子系统来提供相关证据。可选地，该现场审计子系统101可以存储有所服务的经营实体的审计相关数据，例如，采用数据库形式存储，以便进行上述现场或远程的审计，这种本地存储的形式可以避免数据外泄，达到安全保密的目的。
至少一个电子设备102，该至少一个电子设备102可以作为审计客户端使用，例如，电子设备上可以运行有审计客户端，可以安装于任一个电子设备上，例如便携电子设备，如手机、平板电脑等电子设备，当然，也可以是专门的审计设备。电子设备102上可以配置有可信执行环境(TEE,trusted execution environment)或可信应用(TA，trusted application)， 用以存储用户的私钥以及进行签名等操作。对于审计客户端来说，当任一用户在审计系统中注册成功后，可以由审计系统为该用户生成一对密钥，包括公钥和私钥，该公钥可以分发给审计系统里的设备，用以进行签名验证等步骤，而该私钥可以存储于电子设备102的TEE或TA中，以便在有需要时，由电子设备和TEE或TA进行交互，以进行签名等步骤，私钥不能够被导出到TEE或TA以外，大大提高了安全性。电子设备102的TEE或TA中可以存储有已登录的用户的私钥，而当该用户退出登录时，可以对其私钥进行保留或删除。而当有任一用户登录该审计客户端时，可以从审计系统中重新申请生成密钥或者私钥的传送，使得该电子设备的TEE或TA能够获取到私钥，以便实现后续的数据安全保障。
审计结果数据存储子系统103用于存储审计结果数据。该存储可以采用区块链形式进行，也即是，该审计结果数据存储子系统103可以包括多个节点设备(如图4所示)，该各个节点可以设备分别为不同经营实体服务，区块链形式的存储是指对于每个节点设备上所存储的数据具有不可篡改性。
在上述系统中，为了实现审计的安全性和数据保密性，各个用户均需要进行注册，例如被审计方或者审计方，被审计方和审计方均可以注册至少一个账号，以便供自己的审计参与人员使用。例如，在使用审计客户端时，被审计方人员需要首先完成注册，并选择所属的机构名称，如果相关的机构尚未注册，则需要进一步完成机构注册；某被审计机构的人员注册完成后，审计客户端获取相应的公私密钥对(pk1,sk1)；在使用审计客户端时，审计人员需要首先完成注册，并选择所属的审计机构，如果相关的审计机构尚未注册，则需要进一步完成审计机构注册；及，某审计机构的审计人员注册完成后，审计客户端获取相应的公私密钥对(pk2,sk2)。
图5是本申请实施例提供的一种审计结果数据存储方法的流程图。参见图5，该实施例涉及到作为被审计方的第一用户和作为审计方的第二用户，在一个示例性的实施例中，该审计结果数据存储方法包括：
501、通过现场审计子系统和审计项存储子系统之间的交互，获取第一用户的审计对象的一个或多个审计项。
审计人员可以在现场审计子系统进行操作，以输入审计对象，而现场审计子系统可以与审计项存储子系统建立数据连接，从而根据审计对象，从该审计项存储子系统中获取该审计对象关联的一个或多个审计项。当然，该一个或多个审计项可以是该审计对象默认的关联项，审计人员可以实际审计需求对该默认的关联项进行调整(例如删除某个审计项，或者增加某个审计项)，还可以是审计人员基于实际审计需求，从审计项存储子系统中获取的一个或多个审计项，本申请实施例对此不做限定。
502、在该现场审计子系统上基于该审计对象的一个或多个审计项进行审计，得到审计结果数据。
其中，审计结果数据中每个审计项的审计结果包括审计项的散列值、第一用户的特征值的散列值以及审计证据的散列值。由于散列值的不可逆性，因此，基于散列值的数据传递可以保证原始审计数据不被泄露。以该散列值是基于哈希算法得到为例，审计项的散列值Hash(L)，审计对象的特征值的散列值Hash(O)，被审计方所提供的证据的散列值Hash(E)。可选地，审计结果数据中每个审计项的审计结果还包括审计上下文的散列值、第二用户的特征值的散列值、第二用户信息的散列值以及第一用户信息的散列值中至少一项。也即是，审计项还可以包括审计上下文散列值Hash(Con)，审计方的特征值的散列值Hash(D)，审计方 基本信息散列值Hash(A)，被审计方基本信息散列值Hash(O)。
其中，第一用户信息可以为该第一用户所属机构信息或机构代码等等，第二用户信息可以为第二用户所属机构信息或机构代码等等，当然，上述用户信息中还可以包括该用户自身的员工编号等等，本申请实施例对此不做限定。审计上下文是指审计发生地点信息和审计发生时间等等与本次审计相关的信息。
需要说明的是，上述审计可以是审计人员在该现场审计子系统上进行，也可以是由远程接入的审计人员来执行，本申请实施例对此不做限定。
503、现场审计子系统根据审计结果数据的第一散列值，显示第一图形标识码，该第一图形标识码用于表示该审计结果数据。
其中，现场审计子系统基于审计结果数据，生成该审计结果数据的第一散列值。在生成第一散列值之前，可以对审计结果数据中的各个审计项进行组合，以形成新的数据块，再进行散列处理，得到第一散列值。现场审计子系统再基于该第一散列值，生成第一图形标识码，并显示于该现场审计子系统的屏幕上。该第一图形标识码可以为二维码，例如QR(Quick Response，快速反应)码等。
该第一图形标识码还可以标识作为审计方的第二用户，以便在后续流程中使得其他设备能够获知在现场进行审计的人员。
504、第一电子设备通过扫描该第一图形标识码，得到第一图形标识码所表示的第一散列值。
该第一电子设备是指被审计方的第一用户所登录的设备，被审计方的工作人员可以通过该扫码的方式，将第一散列值获取到第一电子设备上进行存储。这种基于图形标识码的数据传递方法，不仅操作方法简单便捷，而且大大提高了整个传递的直观性和可信程度。
需要说明的是，上述步骤503和504是以通过扫码模式来进行数据传递进行说明，而对于现场审计子系统和第一电子设备来说，也可以不采用扫码模式，而是采用其他数据传递方式，例如蓝牙或局域网连接等方式，本申请实施例对此不做限定。
505、第一电子设备将第一散列值发送至第一电子设备的可信执行环境中。
该步骤505中，签名可以是基于授权来进行，也即是，当第一用户认可该审计结果数据时，可以通过第一电子设备来授权对审计结果数据进行签名，来表示被审计方认可该审计结果。而当第一用户不认可该审计结果数据时，可以不授权签名。
第一电子设备的可信执行环境中存储有第一用户的私钥，为了实现数据安全，第一电子设备可以将第一散列值发送至可信执行环境中进行签名，而不是获取私钥自行签名。在一种可能实施方式中，该第一电子设备可以向可信执行环境发送签名指令，该签名指令携带客户端标识和第一散列值，以用于标识需要使用哪个私钥对散列值进行签名。
506、该可信执行环境根据第一用户的私钥对第一散列值进行签名，得到第一签名数据，将该第一签名数据发送至该第一电子设备。
在步骤506中，可信执行环境可以获取该第一用户的私钥，再采用该私钥对第一散列值进行签名。在一种可能实施方式中，该可信执行环境可以对签名指令所携带的客户端标识进行验证，当可信客户端标识包括该客户端标识时，则获取该客户端标识对应的私钥，执行该签名指令。
507、第一电子设备在接收到第一签名数据后，将第一签名数据发送至审计结果数据存储子系统，审计结果数据存储子系统用于存储审计结果数据。审计结果数据存储子系统用于采 用区块链的形式存储数据。
对于该已经签名的第一散列值，第一电子设备可以将该第一签名数据发送给审计结果数据存储子系统，以确定被审计方已经认可该审计结果。
508、审计结果数据存储子系统在接收到第一签名数据后，向第二电子设备发送第一存证证明，第一存证证明用于表示第一签名数据已经存储至审计结果数据存储子系统。
可选地，该审计结果数据存储子系统还可以向第一电子设备返回第一存证证明，以便告知第一电子设备存储完成。当然，该审计结果数据存储子系统还可以向第一电子设备返回进度说明，以告知第一电子设备现阶段的签名已经完成，还需要第二用户的签名才能完成数据存储。
其中，审计结果数据存储子系统在接收到第一签名数据后，可以对第一签名数据进行验证，该验证可以是基于第一用户的公钥进行，当验证通过时，再执行步骤508的第一存证证明的发送步骤以及后续过程。
509、当第二电子设备接收到该第一存证证明时，从审计结果数据存储子系统中获取第一签名数据。
在步骤509中，该从审计结果数据存储子系统中获取第一签名数据，可以是接收该审计结果数据存储子系统发送的第一签名数据，也可以是第二电子设备主动从审计结果数据存储子系统中获取与该第一存证证明对应的第一签名数据，本申请实施例对此不做限定。
510、该第二电子设备将第一签名数据发送至第二电子设备的可信执行环境中。
511、该可信执行环境根据第二用户的私钥对第一签名数据进行签名，得到第二签名数据，将该第二签名数据发送至该第二电子设备。
512、该第二电子设备接收第二签名数据后，将第二签名数据发送至审计结果数据存储子系统，审计结果数据存储子系统用于采用区块链的形式存储数据。
步骤510至步骤512与上述第一电子设备进行签名以及发送的过程同理。
513、该审计结果数据存储子系统对该第二签名数据进行存储。
该第二签名数据为经过第一用户和第二用户签名的数据，得到了审计方和被审计方的双重签名，能够大大提高数据的安全性，而且，通过采用区块链的形式来存储审计结果数据，能够在保证审计结果真实有效的同时，避免数据的泄露。
514、当存储完成后，该审计结果数据存储子系统向第二电子设备发送第二存证证明，第二存证证明用于表示第二签名数据已经存储至审计结果数据存储子系统。
可选地，该审计结果数据存储子系统还可以向第一电子设备返回第二存证证明，以便告知第一电子设备存储完成。
为了更加清晰的表示上述的数据传递过程，下面基于一个示例来对图5提供的实施例进行简要的说明，参见图6，在审计结果数据a生成后，在现场审计子系统上形成与审计结果数据a对应的二维码B0，被审计方可在审计客户端601上登录并选择使用扫码模式，扫描B0，将审计结果a收集到审计客户端，并授权对审计结果a签名，签名时可通过审计客户端的TEE实现，由TEE使用上述私钥sk1,签名得到的第一签名数据可以表示为Sign(a)，并将Sign(a)发送至审计结果数据存储子系统，由审计结果数据存储子系统将Sign(a)发送给第二用户所登录的审计客户端602，由第二用户在审计客户端602上授权对Sign(a)进行签名，得到Sign(b)，并将Sign(b)发送至审计结果数据存储子系统进行存储。
上述存储方法，通过不进行实际审计结果数据的传递，而是将审计结果数据的散列值通 过多方签名的方式后，存储至审计结果数据存储子系统中，大大降低了数据泄露的可能性，能够为敏感信息提供安全保障。
上述图5所示实施例为第一用户和第二用户之间基于审计结果数据存储子系统的数据传递来分别进行签名为例进行说明，而在图7所示实施例中，示出了一种第一用户和第二用户基于图形标识码来进行数据传递，以进行签名为例进行说明的过程，参见图7，该实施例具体包括：
701、通过现场审计子系统和审计项存储子系统之间的交互，获取第一用户的审计对象的多个审计项。
702、在该现场审计子系统上基于该审计对象的多个审计项进行审计，得到审计结果数据。
703、现场审计子系统根据审计结果数据的第一散列值，显示第一图形标识码，该第一图形标识码用于表示该审计结果数据。
704、第一电子设备通过扫描该第一图形标识码，得到第一图形标识码所表示的第一散列值。
705、第一电子设备将第一散列值发送至第一电子设备的可信执行环境中。
706、该可信执行环境根据第一用户的私钥对第一散列值进行签名，得到第一签名数据，将该第一签名数据发送至该第一电子设备。
上述步骤701至步骤706与步骤501至506同理。
707、第一电子设备在接收到第一签名数据后，显示第二图形标识码，第二图形标识码用于表示第一签名数据。
被审计方的工作人员可以在第一电子设备上选择扫码模式，以通过面对面的方式，来由审计方的工作人员通过扫码来得到第一签名数据，操作简单直观。
708、第二电子设备通过扫描该第二图形标识码，得到第二图形标识码所表示的第一签名数据。
该第二电子设备是指审计方的第二用户所登录的设备，审计方的工作人员可以通过该扫码的方式，将第一签名数据获取到第二电子设备上进行存储。这种基于图形标识码的数据传递方法，不仅操作方法简单便捷，而且大大提高了整个传递的直观性和可信程度。
需要说明的是，上述步骤是以通过扫码模式来进行数据传递进行说明，而对于第一电子设备和第二电子设备来说，也可以不采用扫码模式，而是采用其他数据传递方式，例如蓝牙或局域网连接等方式，本申请实施例对此不做限定。
709、该第二电子设备将第一签名数据发送至第二电子设备的可信执行环境中。
710、该可信执行环境根据第二用户的私钥对第一签名数据进行签名，得到第二签名数据，将该第二签名数据发送至该第二电子设备。
711、该第二电子设备接收第二签名数据后，将第二签名数据发送至审计结果数据存储子系统，审计结果数据存储子系统用于存储审计结果数据。
712、该审计结果数据存储子系统对该第二签名数据进行存储。
713、当存储完成后，该审计结果数据存储子系统向第二电子设备发送第二存证证明，第二存证证明用于表示第二签名数据已经存储至审计结果数据存储子系统。
步骤709至713与步骤510至514同理。
为了更加清晰的表示上述的数据传递过程，下面基于一个示例来对图7提供的实施例进行简要的说明，参见图8，在审计结果数据a生成后，在现场审计子系统上形成与审计结果 数据a对应的二维码B0，被审计方可在审计客户端801上登录并选择使用扫码模式，扫描B0，将审计结果a收集到审计客户端801，并授权对审计结果a签名，签名时可通过审计客户端的TEE实现，由TEE使用上述私钥sk1,签名得到的第一签名数据可以表示为Sign(a)，在Sign(a)生成后，审计客户端上形成与Sign(a)对应的二维码B1，在审计客户端，审计方可关联被审计方,审计方可选择使用扫码模式，将审计结果B1所对应的Sign(a)数据收集到审计客户端802，由第二用户在审计客户端802上授权对Sign(a)进行签名，得到Sign(b)，并将Sign(b)发送至审计结果数据存储子系统进行存储。
上述存储方法，通过不进行实际审计结果数据的传递，而是将审计结果数据的散列值通过多方签名的方式后，存储至审计结果数据存储子系统中，大大降低了数据泄露的可能性，能够为敏感信息提供安全保障。
对于审计结果数据存储子系统来说，可以采用区块链的形式存储数据，下面通过图9所示来对存储过程进行说明，该过程可以应用于上述图5或图7的流程中。
901、该审计结果数据存储子系统中的任一节点设备接收第二电子设备发送的第二签名数据，第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，第一散列值用于表示第一用户的审计结果数据。
902、该节点设备对第二签名数据进行验证，当验证通过时，在审计结果数据存储子系统中广播第二签名数据。
对于任一个节点设备来说，该节点设备存储有各个用户的公钥，以用于身份验证，因此，步骤902具体可以包括：基于第一用户的公钥和第二用户的公钥，对第二签名数据进行验证。
其中，该验证可以包括采用第二用户的公钥和第一用户的公钥对第二签名数据进行解密，以得到第一散列值，如果解密成功，则验证通过，如果解密不成功，则验证不通过。
903、当审计结果数据存储子系统对第二签名数据共识通过时，该节点设备将第二签名数据存储至审计结果数据存储子系统的区块链中。
对于任一个节点设备来说，可以接收步骤902中节点设备所广播的第二签名数据，并对第二签名数据进行验证，当验证通过时，该节点设备可以广播验证通过消息，各个节点设备可以基于所接收到的验证通过消息，来确定该第二签名数据是否共识通过，本申请实施例对此不做限定。当然，上述的共识过程仅是一种示例性的说明，对于应用有其他共识机制的系统来说，还可以有其他共识方式，本申请实施例对此不做限定。
通过采用区块链形式对签名数据进行存储，在对数据本身进行安全保障的同时，还可以避免数据被篡改，且由于区块链本身的数据处理效率较高，也能够提高查询的效率。
可选地，在进行存储时，可以将第二签名数据与区块链中第一用户的已存储数据进行关联存储，以便于查询。在关联存储时，可以采用下述任一方式：一种可能实施方式中，可以采用第二签名数据中所包括的被审计方对应的散列值，获取被审计方在区块链中已存储的数据，并基于第二签名数据和被审计方的已存储数据，来生成新的区块，在该新的区块中以Merkel树方式来记录该被审计方的历史审计情况。这种以区块来存储的方式，可以在每接收到一次第二签名数据时进行。而在又一种可能实施方式中，各个节点设备可以为每个第一用户维护对应的Merkel树，基于共识通过的签名数据来对每个第一用户对应的Merkel树进行更新。该过程可以是每接收到一次第二签名数据时进行，也可以是在区块高度达到一定值的时候进行，本申请实施例对此不做限定。可选地，上述Merkel树的存储可以通过容器来实现。
对于Merkel树示例如下，参见图10，被审计方K公司于2018年实施了p次审计，2017 年实施了n次审计；
对于2017年的n次审计，记为C1至Cn，其中，以审计C1为例所涉及的审计项有m项时，各个审计项所对应的审计结果的散列值为RC11，RC12，…,RC1m；则可以将审计C1的各个审计项的审计结果的散列值组合，进行散列，得到审计C1对应的审计结果的散列值为C1＝hash(RC11，RC12，…,RC1m)，对于审计Cn，所涉及的审计项有x项时，各个审计项所对应的审计结果的散列值为RCn1，RCn2，…,RCnx，则可以将审计Cn的各个审计项的审计结果的散列值组合，进行散列，得到审计Cn对应的审计结果的散列值为Cn＝hash(RCn1，RCn2，…,RCnx)；
对于2018年的p次审计，记为D1至Dp，审计Dp所涉及的审计项有y项时，各个审计项所对应的审计结果的散列值为RDp1，RDp2，…,RDpy，则可以将审计Dp的各个审计项的审计结果的散列值组合，进行散列，得到审计Dp对应的审计结果的散列值为Dp＝hash(RDp1，RDp2，…,RDpy)；
2017年涉及的n次审计的散列值组合后，得到(C1…,Cn)，再次进行散列，生成散列值Y2017＝hash(C1…,Cn)；2018年涉及的p次审计的散列值组合后，得到(D1…,Dp)，再次进行散列，得到散列值Y2018＝hash(D1…,Dp)；及
则K公司的审计结果Merkel根为各年度散列值Y2017、Y2018的组合后，再进行散列所得到的散列值K＝hash(Y2017，Y2018)。
可选地，基于上述关联存储，可以实现审计结果数据的快捷查询，具体如下：审计结果数据存储子系统基于审计结果数据存储子系统中第三用户对应的数据，生成第三用户的查询页面，第三用户的查询页面中包括第三用户的审计结果。第三用户对应的数据包括该第三用户的历史审计结果，由于在对第三用户的每次审计后，均会将用于表示第三用户的审计结果的签名数据存储至该审计结果数据存储子系统，且每次存储时均采用了关联存储的方式，使得第三用户的各次审计所得到的数据具有关联性，因此，在生成该第三用户的查询页面时，可以根据签名数据之间的时间关系，来生成在时间上有关联的各次审计结果。例如，第三用户的审计结果包括以年、半年、季度以及月份中至少一项划分的审计结果项。以上述示出的merkel树为例，该查询页面上可以包括以年为单位的审计结果项，每个以年为单位的审计结果项下还挂载有以季度为单位的审计结果项等等，本申请实施例对此不做限定。而查询者可以基于任一个审计结果项进行查看，通过对该审计结果项的点击操作，来触发查看指令，以跳转到该审计结果项的信息页面等，本申请实施例对此不做限定。
当然，上述对查询页面的显示可以是基于图形标识码实现的，也就是，审计结果数据存储子系统在接收到页面查询请求时，可以根据页面查询请求携带的被审计用户的特征值的散列值等信息作为查询索引，来采用图形标识码的方式，提供查询页面的页面链接地址，而当查询者对该页面链接地址进行访问时，可以在其访问设备上显示该查询页面。在一种可能实施方式中，查询过程还可以基于被审计用户的特征值的散列值以外的查询索引，例如，可以基于审计方的特征值的散列值，又或者，基于审计上下文信息的散列值等等，本申请实施例对此不做限定。
在一种可能实施方式中，第三电子设备可以通过扫描任一电子设备提供的第三图形标识码，得到第三用户的查询页面的页面链接地址；发送网页访问请求，网页访问请求用于访问第三用户的查询页面的页面链接地址；显示第三用户的查询页面，查询页面中包括第三用户的审计结果。其中，第三用户的审计结果包括以年、半年、季度或者月份中至少一项划分的 审计结果项。显示第三用户的查询页面之后，当接收到对任一审计结果项的查看指令，获取审计结果项对应的审计结果数据。
通过上述数据存储方式，使得一个用户与该用户在历史上进行的审计结果等关联起来，不仅可以大大提高查询的效率，还能够使得数据更具有规范性。进一步地，通过以图形标识码的方式来提供查询页面的链接地址，也能够达到直观、便捷的查询。
应该理解的是，本申请各实施例中的各个步骤并不是必然按照步骤标号指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，各实施例中至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
图11是本申请实施例提供的一种审计结果数据存储装置的结构示意图。该装置应用于第一电子设备上，装置包括：
散列获取模块1101，用于获取第一用户的审计结果数据的第一散列值；
签名模块1102，用于根据第一用户的私钥对第一散列值进行签名，得到第一签名数据；及
发送模块1103，用于将第一签名数据发送至审计结果数据存储子系统，审计结果数据存储子系统用于采用区块链的形式存储数据。
在一种可能实施方式中，散列获取模块1101用于通过扫描任一电子设备所提供的第一图形标识码，得到第一图形标识码所表示的第一散列值。
在一种可能实施方式中，审计结果数据中每个审计项的审计结果包括审计项的散列值、第一用户的特征值的散列值以及审计证据的散列值。
在一种可能实施方式中，审计结果数据中每个审计项的审计结果还包括审计上下文的散列值、第二用户的特征值的散列值、第二用户信息的散列值以及第一用户信息的散列值中至少一项。
在一种可能实施方式中，签名模块用于：
将第一散列值发送至第一电子设备的可信执行环境中；及
接收第一签名数据，第一签名数据由第一电子设备的可信执行环境根据第一用户的私钥对第一散列值进行签名得到，第一用户的私钥由审计系统在第一用户注册成功后生成。
在一种可能实施方式中，装置还包括：
显示模块，用于根据第一签名数据，显示第二图形标识码，第二图形标识码用于表示第一签名数据。
需要说明的是：上述实施例提供的审计结果数据存储装置在审计结果数据存储时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的审计结果数据存储方法实施例属于同一构思，其具体实现过程详见方法实施例。
图12是本申请实施例提供的一种审计结果数据存储装置的结构示意图。该装置应用于第二电子设备上，装置包括：
获取模块1201，用于获取第一签名数据，第一签名数据用于表示第一用户的审计结果数 据；
签名模块1202，用于根据第二用户的私钥对第一签名数据进行签名，得到第二签名数据；及
发送模块1203，用于将第二签名数据发送至审计结果数据存储子系统，审计结果数据存储子系统用于采用区块链的形式存储数据。
在一种可能实施方式中，签名模块用于：
将第一签名数据发送至第二电子设备的可信执行环境中；及
接收第二签名数据，第二签名数据由第二电子设备的可信执行环境根据第二用户的私钥对第一签名数据进行签名得到，第二用户的私钥由审计系统在第二用户注册成功后生成。
在一种可能实施方式中，获取模块用于通过扫描第一电子设备所提供的第二图形标识码，得到第二图形标识码所表示的第一签名数据。
在一种可能实施方式中，获取模块用于接收审计结果数据存储子系统的第一存证证明，第一存证证明用于表示第一签名数据已经存储至审计结果数据存储子系统；及，从审计结果数据存储子系统中获取第一签名数据。
在一种可能实施方式中，装置还包括：
接收模块，用于接收审计结果数据存储子系统的第二存证证明，第二存证证明用于表示第二签名数据已经存储至审计结果数据存储子系统。
需要说明的是：上述实施例提供的审计结果数据存储装置在审计结果数据存储时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的审计结果数据存储方法实施例属于同一构思，其具体实现过程详见方法实施例。
图13是本申请实施例提供的一种审计结果数据存储装置的结构示意图。该装置应用于审计结果数据存储子系统中的任一节点设备，审计结果数据存储子系统中的多个节点设备配置有共识机制，包括：
接收模块1301，用于接收第二电子设备发送的第二签名数据，第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，第一散列值用于表示第一用户的审计结果数据；
验证模块1302，用于对第二签名数据进行验证；
发送模块1303，用于当验证通过时，在审计结果数据存储子系统中广播第二签名数据；及
存储模块1304，用于当审计结果数据存储子系统对第二签名数据共识通过时，将第二签名数据存储至审计结果数据存储子系统中。
在一种可能实施方式中，验证模块用于基于第一用户的公钥和第二用户的公钥，对第二签名数据进行验证。
在一种可能实施方式中，存储模块用于将第二签名数据与区块链中第一用户的已存储数据进行关联存储。
在一种可能实施方式中，装置还包括：
页面生成模块，用于基于审计结果数据存储子系统中第三用户对应的数据，生成第三用户的查询页面，第三用户的查询页面中包括第三用户的审计结果。
在一种可能实施方式中，装置还包括：
地址提供模块，用于以图形标识码的形式，提供第三用户的查询页面的页面链接地址。
在一种可能实施方式中，接收模块还用于接收第一电子设备发送的第一签名数据，根据第一签名数据，向第二电子设备发送第一存证证明，第一存证证明用于表示第一签名数据已经存储至审计结果数据存储子系统。
在一种可能实施方式中，发送模块还用于向第二电子设备发送第二存证证明，第二存证证明用于表示第二签名数据已经存储至审计结果数据存储子系统。
需要说明的是：上述实施例提供的审计结果数据存储装置在审计结果数据存储时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的审计结果数据存储方法实施例属于同一构思，其具体实现过程详见方法实施例。
图14是本申请实施例提供的一种审计结果数据查询装置的结构示意图，参见图14，该装置包括：
地址获取模块1401，用于通过扫描任一电子设备提供的第三图形标识码，得到第三用户的查询页面的页面链接地址；
发送模块1402，用于发送网页访问请求，网页访问请求用于访问第三用户的查询页面的页面链接地址；及
显示模块1403，用于显示第三用户的查询页面，查询页面中包括第三用户的审计结果。
在一种可能实施方式中，第三用户的审计结果包括以年、半年、季度以及月份中至少一项划分的审计结果项。
在一种可能实施方式中，装置还包括：
数据获取模块，用于当接收到对任一审计结果项的查看指令，获取审计结果项对应的审计结果数据。
需要说明的是：上述实施例提供的审计结果数据查询装置在审计结果数据查询时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的审计结果数据查询方法实施例属于同一构思，其具体实现过程详见方法实施例。
图15是本申请实施例提供的一种审计项存储装置的结构示意图，参见图15，装置还包括：
审计项录入模块1501，用于获取待录入的审计项；
散列获取模块1502，用于获取待录入的审计项的第二散列值；
查询模块1503，用于根据第二散列值，在待录入的审计项所属审计领域的已有审计项的散列值中进行查询；及
存储模块1504，用于当已有审计项的散列值包括与第二散列值相同的散列值，不存储待录入的审计项。
在一种可能实施方式中，存储模块还用于如果已有审计项的散列值中不包括与第二散列值相同的散列值，而已有审计项中包括与待录入的审计项的相似度大于第一相似度阈值的审计项，则存储待录入的审计项。
在一种可能实施方式中，存储模块还用于如果已有审计项的散列值中不包括与第二散列值相同的散列值，而同一个审计领域的已有审计项中包括与待录入的审计项的相似度小于第一相似度阈值的审计项，根据人工评测结果确定是否存储待录入的审计项。
在一种可能实施方式中，装置应用于审计项存储系统中，审计项存储系统用于以区块链的形式存储各个审计项。
需要说明的是：上述实施例提供的审计项存储装置在审计项存储时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的审计项存储方法实施例属于同一构思，其具体实现过程详见方法实施例。
本申请实施例还提供的一种审计系统，审计系统包括：审计项存储子系统、现场审计子系统、至少一个电子设备以及审计结果数据存储子系统；
审计项存储子系统用于存储多个审计项；
现场审计子系统用于与审计项存储子系统交互，以提供第一用户的审计页面，得到第一用户的审计结果数据，为至少一个电子设备中的第一电子设备提供第一用户的审计结果数据的第一散列值；
第一电子设备用于根据第一用户的私钥对第一散列值进行签名，得到第一签名数据；
第二电子设备用于根据第二用户的私钥对第一签名数据进行签名，得到第二签名数据，将第二签名数据发送至审计结果数据存储子系统；及
审计结果数据存储子系统用于采用区块链的形式存储第二签名数据。
图16是本申请实施例提供的一种电子设备的结构示意图，该电子设备1600可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)1601和一个或一个以上的存储器1602，其中，该存储器1602中存储有至少一条指令，该至少一条指令由该处理器1601加载并执行以实现上述各个方法实施例提供的方法。当然，该电子设备还可以具有有线或无线网络接口、键盘以及输入输出接口等部件，以便进行输入输出，该电子设备还可以包括其他用于实现设备功能的部件。
在示例性实施例中，还提供了一种计算机可读存储介质，例如包括指令的存储器，上述指令可由终端中的处理器执行以完成上述实施例中的审计结果数据存储方法或查询方法或审计项存储方法等上述各个方法实施例提供的方法。例如，该计算机可读存储介质可以是只读存储器(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory，RAM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)、磁带、软盘和光数据存储设备等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
上述仅为本申请的较佳实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种审计结果数据存储方法，由第一电子设备执行，包括：
    获取第一用户的审计结果数据的第一散列值；
    根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；及
    将所述第一签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
  2. 根据权利要求1所述的方法，其特征在于，所述审计结果数据中每个审计项的审计结果包括审计项的散列值、所述第一用户的特征值的散列值以及审计证据的散列值。
  3. 根据权利要求1所述的方法，其特征在于，所述根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据包括：
    将所述第一散列值发送至所述第一电子设备的可信执行环境中；及
    接收第一签名数据，所述第一签名数据由所述第一电子设备的可信执行环境根据所述第一用户的私钥对所述第一散列值进行签名得到，所述第一用户的私钥由审计系统在所述第一用户注册成功后生成。
  4. 一种审计结果数据存储方法，由第二电子设备执行，包括：
    获取第一签名数据，所述第一签名数据用于表示第一用户的审计结果数据；
    根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据；及
    将所述第二签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
  5. 一种审计结果数据存储方法，由审计结果数据存储子系统中的任一节点设备执行，所述审计结果数据存储子系统中的多个节点设备配置有共识机制，包括：
    接收第二电子设备发送的第二签名数据，所述第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，所述第一散列值用于表示所述第一用户的审计结果数据；
    对所述第二签名数据进行验证；
    当验证通过时，在审计结果数据存储子系统中广播所述第二签名数据；及
    当所述审计结果数据存储子系统对所述第二签名数据共识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
  6. 一种审计结果数据查询方法，由第三电子设备执行，包括：
    通过扫描任一电子设备提供的第三图形标识码，得到第三用户的查询页面的页面链接地址；
    发送网页访问请求，所述网页访问请求用于访问所述第三用户的查询页面的页面链接地址；及
    显示所述第三用户的查询页面，所述查询页面中包括所述第三用户的审计结果。
  7. 一种审计项存储方法，由审计项存储子系统执行，包括：
    获取待录入的审计项；
    获取所述待录入的审计项的第二散列值；
    根据所述第二散列值，在所述待录入的审计项所属审计领域的已有审计项的散列值中进行查询；及
    当所述已有审计项的散列值包括与所述第二散列值相同的散列值，不存储所述待录入的审计项。
  8. 一种审计结果数据存储装置，包括：
    散列获取模块，用于获取第一用户的审计结果数据的第一散列值；
    签名模块，用于根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；及
    发送模块，用于将所述第一签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
  9. 一种审计结果数据存储装置，包括：
    获取模块，用于获取第一签名数据，所述第一签名数据用于表示第一用户的审计结果数据；
    签名模块，用于根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据；及
    发送模块，用于将所述第二签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
  10. 一种审计结果数据存储装置，包括：
    接收模块，用于接收第二电子设备发送的第二签名数据，所述第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，所述第一散列值用于表示所述第一用户的审计结果数据；
    验证模块，用于对所述第二签名数据进行验证；
    发送模块，用于当验证通过时，在审计结果数据存储子系统中广播所述第二签名数据；及
    存储模块，用于当所述审计结果数据存储子系统对所述第二签名数据共识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
  11. 一种审计项存储装置，包括：
    审计项录入模块，用于获取待录入的审计项；
    散列获取模块，用于获取所述待录入的审计项的第二散列值；
    查询模块，用于根据所述第二散列值，在所述待录入的审计项所属审计领域的已有审计项的散列值中进行查询；及
    存储模块，用于当所述已有审计项的散列值包括与所述第二散列值相同的散列值，不存储所述待录入的审计项。
  12. 一种审计结果数据存储方法，包括：
    第一电子设备获取第一用户的审计结果数据的第一散列值，根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；
    第二电子设备在获取到所述第一签名数据后，根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据，将所述第二签名数据发送至审计结果数据存储子系统；及
    所述审计结果数据存储子系统接收到所述第二签名数据后，如果对所述第二签名数据共 识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
  13. 一种审计系统，所述审计系统包括：审计项存储子系统、现场审计子系统、至少一个电子设备以及审计结果数据存储子系统；
    所述审计项存储子系统用于存储多个审计项；
    所述现场审计子系统用于与所述审计项存储子系统交互，以提供第一用户的审计页面，得到所述第一用户的审计结果数据，为所述至少一个电子设备中的第一电子设备提供所述第一用户的审计结果数据的第一散列值；
    所述第一电子设备用于根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；
    所述第二电子设备用于根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据，将所述第二签名数据发送至所述审计结果数据存储子系统；及
    所述审计结果数据存储子系统用于采用区块链的形式存储所述第二签名数据。
  14. 一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
    获取第一用户的审计结果数据的第一散列值；
    根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据；及
    将所述第一签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
  15. 根据权利要求14所述的电子设备，其特征在于，所述根据所述第一用户的私钥对所述第一散列值进行签名，得到第一签名数据包括：
    将所述第一散列值发送至所述第一电子设备的可信执行环境中；及
    接收第一签名数据，所述第一签名数据由所述第一电子设备的可信执行环境根据所述第一用户的私钥对所述第一散列值进行签名得到，所述第一用户的私钥由审计系统在所述第一用户注册成功后生成。
  16. 一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
    获取第一签名数据，所述第一签名数据用于表示第一用户的审计结果数据；
    根据第二用户的私钥对所述第一签名数据进行签名，得到第二签名数据；及
    将所述第二签名数据发送至审计结果数据存储子系统，所述审计结果数据存储子系统用于采用区块链的形式存储数据。
  17. 一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
    接收第二电子设备发送的第二签名数据，所述第二签名数据用于表示经过作为被审计方的第一用户和作为审计方的第二用户签名的第一散列值，所述第一散列值用于表示所述第一用户的审计结果数据；
    对所述第二签名数据进行验证；
    当验证通过时，在审计结果数据存储子系统中广播所述第二签名数据；及
    当所述审计结果数据存储子系统对所述第二签名数据共识通过时，将所述第二签名数据存储至所述审计结果数据存储子系统中。
  18. 一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
    通过扫描任一电子设备提供的第三图形标识码，得到第三用户的查询页面的页面链接地址；
    发送网页访问请求，所述网页访问请求用于访问所述第三用户的查询页面的页面链接地址；及
    显示所述第三用户的查询页面，所述查询页面中包括所述第三用户的审计结果。
  19. 一种电子设备，包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，使得所述处理器执行如下步骤：
    获取待录入的审计项；
    获取所述待录入的审计项的第二散列值；
    根据所述第二散列值，在所述待录入的审计项所属审计领域的已有审计项的散列值中进行查询；及
    当所述已有审计项的散列值包括与所述第二散列值相同的散列值，不存储所述待录入的审计项。
  20. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被一个或多个处理器执行时，使得一个或多个处理器执行权利要求1至权利要求7任一项所述方法的步骤。
PCT/CN2019/108666 2018-10-10 2019-09-27 审计结果数据存储、查询方法、审计项存储方法及装置 WO2020073828A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/073,191 US11316669B2 (en) 2018-10-10 2020-10-16 Audit result data storage method and device, audit result data query method and device, and audit item storage method and device
US17/700,433 US11700113B2 (en) 2018-10-10 2022-03-21 Audit result data storage method and device, audit result data query method and device, and audit item storage method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811179316.6A CN110309259B (zh) 2018-10-10 2018-10-10 审计结果数据存储、查询方法、审计项存储方法及装置
CN201811179316.6 2018-10-10

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/073,191 Continuation US11316669B2 (en) 2018-10-10 2020-10-16 Audit result data storage method and device, audit result data query method and device, and audit item storage method and device

Publications (1)

Publication Number Publication Date
WO2020073828A1 true WO2020073828A1 (zh) 2020-04-16

Family

ID=68074088

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/108666 WO2020073828A1 (zh) 2018-10-10 2019-09-27 审计结果数据存储、查询方法、审计项存储方法及装置

Country Status (3)

Country Link
US (2) US11316669B2 (zh)
CN (4) CN110309259B (zh)
WO (1) WO2020073828A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112102098A (zh) * 2020-08-12 2020-12-18 泰康保险集团股份有限公司 数据处理方法、装置、电子设备及存储介质
CN114598693A (zh) * 2020-12-07 2022-06-07 国家广播电视总局广播电视科学研究院 文件内容审核方法、装置及电子设备
CN114598699A (zh) * 2020-12-07 2022-06-07 国家广播电视总局广播电视科学研究院 文件内容审核方法、装置及电子设备

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111062790A (zh) * 2019-11-15 2020-04-24 深圳供电局有限公司 一种基于企业内部审计成果的数据分析方法及系统
CN111984216B (zh) * 2020-08-26 2023-03-31 成都安恒信息技术有限公司 一种对字符运维的图形审计方法及系统
US11681784B2 (en) * 2020-09-03 2023-06-20 Arista Networks, Inc. Hardware license verification
CN112347119A (zh) * 2020-09-18 2021-02-09 杭州安恒信息安全技术有限公司 应用于审计系统的数据存储方法、装置和计算机设备
US11966782B2 (en) * 2021-09-24 2024-04-23 Dell Products L.P. Method and system for performing historical state management services for composed information handling systems

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103136243A (zh) * 2011-11-29 2013-06-05 中国电信股份有限公司 基于云存储的文件系统去重方法及装置
US8639753B1 (en) * 2012-09-18 2014-01-28 Squash Compression, LLC Methods and apparatus for increasing the efficiency of electronic data storage and transmission
CN105072086A (zh) * 2015-07-06 2015-11-18 武汉科技大学 一种基于MapReduce的云存储批量审计方法
CN107124403A (zh) * 2017-04-14 2017-09-01 朱清明 区块链中共识区块的生成方法与计算设备
CN107231351A (zh) * 2017-05-25 2017-10-03 远光软件股份有限公司 电子证件的管理方法及相关设备
CN108614974A (zh) * 2018-04-24 2018-10-02 南京邮电大学 一种基于区块链的快递信息隐私保护系统及其保护方法

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8943332B2 (en) * 2006-10-31 2015-01-27 Hewlett-Packard Development Company, L.P. Audit-log integrity using redactable signatures
CN102799990A (zh) * 2012-06-19 2012-11-28 袁开国 基于pki的双二维码产品防伪方案
US9678975B2 (en) * 2013-03-15 2017-06-13 International Business Machines Corporation Reducing digest storage consumption in a data deduplication system
CN104581149B (zh) * 2015-01-27 2017-08-08 北京正奇联讯科技有限公司 视音频文件的技审方法和系统
WO2016131575A1 (en) 2015-02-20 2016-08-25 Telefonaktiebolaget Lm Ericsson (Publ) Method of providing a hash value for a piece of data, electronic device and computer program
US10402792B2 (en) * 2015-08-13 2019-09-03 The Toronto-Dominion Bank Systems and method for tracking enterprise events using hybrid public-private blockchain ledgers
CN109150548B (zh) * 2015-12-01 2021-10-08 神州融安科技（北京）有限公司 一种数字证书签名、验签方法及系统、数字证书系统
CN106874253A (zh) * 2015-12-11 2017-06-20 腾讯科技（深圳）有限公司 识别敏感信息的方法及装置
US10592670B2 (en) * 2016-06-28 2020-03-17 Intel Corporation Technologies for provisioning and managing secure launch enclave with platform firmware
US10826685B1 (en) * 2016-06-28 2020-11-03 Amazon Technologies, Inc. Combined blockchain integrity
CN106485168A (zh) * 2016-10-17 2017-03-08 成都知道创宇信息技术有限公司 一种采用md5值验证合同文件是否被修改的方法
US20190266146A1 (en) * 2016-11-10 2019-08-29 Saavha, Inc. Secure auditing system based on verified hash algorithm
CN107194801A (zh) * 2017-05-18 2017-09-22 电子科技大学 基于主权区块链的供应链金融区块链应用方法
CN107241317B (zh) * 2017-05-24 2021-01-15 国民认证科技（北京）有限公司 生物特征识别身份的方法和用户终端设备以及身份认证服务器
CN107682308B (zh) * 2017-08-16 2019-12-13 北京航空航天大学 基于区块链潜信道技术的电子证据保存系统
CN107483585B (zh) * 2017-08-18 2020-03-10 西安电子科技大学 云环境中支持安全去重的高效数据完整性审计系统及方法
CN107846278B (zh) * 2017-10-30 2020-02-14 中国联合网络通信集团有限公司 智能合约处理方法及装置
CN107888375A (zh) * 2017-11-08 2018-04-06 深圳市携网科技有限公司 一种基于区块链技术的电子证据保全系统及方法
CN108600199A (zh) * 2018-04-08 2018-09-28 国网浙江省电力有限公司电力科学研究院 一种基于区块链的审计数据的传输方法及系统
CN108446407B (zh) * 2018-04-12 2021-04-30 北京百度网讯科技有限公司 基于区块链的数据库审计方法和装置
CN108462724B (zh) 2018-05-17 2020-07-31 京东数字科技控股有限公司 数据共享方法、装置、系统、成员节点和可读存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103136243A (zh) * 2011-11-29 2013-06-05 中国电信股份有限公司 基于云存储的文件系统去重方法及装置
US8639753B1 (en) * 2012-09-18 2014-01-28 Squash Compression, LLC Methods and apparatus for increasing the efficiency of electronic data storage and transmission
CN105072086A (zh) * 2015-07-06 2015-11-18 武汉科技大学 一种基于MapReduce的云存储批量审计方法
CN107124403A (zh) * 2017-04-14 2017-09-01 朱清明 区块链中共识区块的生成方法与计算设备
CN107231351A (zh) * 2017-05-25 2017-10-03 远光软件股份有限公司 电子证件的管理方法及相关设备
CN108614974A (zh) * 2018-04-24 2018-10-02 南京邮电大学 一种基于区块链的快递信息隐私保护系统及其保护方法

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112102098A (zh) * 2020-08-12 2020-12-18 泰康保险集团股份有限公司 数据处理方法、装置、电子设备及存储介质
CN112102098B (zh) * 2020-08-12 2023-10-27 泰康保险集团股份有限公司 数据处理方法、装置、电子设备及存储介质
CN114598693A (zh) * 2020-12-07 2022-06-07 国家广播电视总局广播电视科学研究院 文件内容审核方法、装置及电子设备
CN114598699A (zh) * 2020-12-07 2022-06-07 国家广播电视总局广播电视科学研究院 文件内容审核方法、装置及电子设备
CN114598699B (zh) * 2020-12-07 2023-07-28 国家广播电视总局广播电视科学研究院 文件内容审核方法、装置及电子设备
CN114598693B (zh) * 2020-12-07 2023-11-21 国家广播电视总局广播电视科学研究院 文件内容审核方法、装置及电子设备

Also Published As

Publication number Publication date
US20220216986A1 (en) 2022-07-07
US20210105133A1 (en) 2021-04-08
CN111008264A (zh) 2020-04-14
CN110309259A (zh) 2019-10-08
CN113642040B (zh) 2023-02-10
US11700113B2 (en) 2023-07-11
CN110309259B (zh) 2021-09-03
CN111079197A (zh) 2020-04-28
CN113642040A (zh) 2021-11-12
US11316669B2 (en) 2022-04-26
CN111079197B (zh) 2021-07-09

Similar Documents

Publication Publication Date Title
WO2020073828A1 (zh) 审计结果数据存储、查询方法、审计项存储方法及装置
US11451530B2 (en) Systems, methods, and apparatuses for implementing super community and community sidechains with consent management for distributed ledger technologies in a cloud based computing environment
US20230342734A1 (en) Systems, methods, and apparatuses for implementing smart flow contracts using distributed ledger technologies in a cloud based computing environment
US10564936B2 (en) Data processing systems for identity validation of data subject access requests and related methods
US11257073B2 (en) Systems, methods, and apparatuses for implementing machine learning models for smart contracts using distributed ledger technologies in a cloud based computing environment
TWI764037B (zh) 跨區塊鏈的交互方法及系統、電腦設備及儲存媒體
US20190236562A1 (en) Systems, methods, and apparatuses for implementing document interface and collaboration using quipchain in a cloud based computing environment
US20190238316A1 (en) Systems, methods, and apparatuses for implementing intelligent consensus, smart consensus, and weighted consensus models for distributed ledger technologies in a cloud based computing environment
US20190236606A1 (en) Systems, methods, and apparatuses for implementing a virtual chain model for distributed ledger technologies in a cloud based computing environment
CN110728494A (zh) 不动产业务的办理方法、不动产权信息系统及装置
US20230208642A1 (en) Secure data transfer system and method
CN115756255A (zh) 停车场设备的设备参数处理方法、装置、设备和存储介质
US20230148248A1 (en) Systems and methods for user data collection
Boi et al. Blockchain oracles for document certification: A case study.
JP2024055413A (ja) 電子契約プログラム、情報処理装置、情報処理システムの製造方法、情報処理方法
Wei et al. A Low-quality Data User Identification Method Based on Blockchain
JP2022075337A (ja) 情報処理方法、情報処理システム及びコンピュータプログラム
CN117493335A (zh) 报表处理方法、装置、设备、存储介质和计算机程序产品
CN117495519A (zh) 金融凭证处理方法、装置、计算机设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19871141

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19871141

Country of ref document: EP

Kind code of ref document: A1