WO2021170049A1

WO2021170049A1 - Method and apparatus for recording access behavior

Info

Publication number: WO2021170049A1
Application number: PCT/CN2021/077955
Authority: WO
Inventors: 洪佳楠; 张艳平; 胡伟华
Original assignee: 华为技术有限公司
Priority date: 2020-02-29
Filing date: 2021-02-25
Publication date: 2021-09-02
Also published as: CN113328979B; CN113328979A

Abstract

The present application relates to the technical field of communications. Disclosed are a method and apparatus for recording an access behavior. The method comprises: an access device acquiring, from a cloud platform, encrypted user data and the address of a first behavior in a smart contract in a blockchain, wherein the first behavior is used for recording the behavior of a data recording network element storing a first key in a database by means of the blockchain; the access device applying to the blockchain to acquire user data, wherein the application to acquire user data carries the address of the first behavior; and after passing verification by the blockchain, the access device receiving the first key from the blockchain, and decrypting the encrypted user data by using the first key. In this method, each apparatus only stores some user data information, thereby reducing the risk of user data leakage due to an attack on a certain apparatus. A traceable recording method based on blockchain technology and having higher security is provided.

Description

Method and device for recording access behavior

Cross-references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on February 29, 2020, the application number is 202010131927.4, and the application title is "a method and device for recording access behavior", the entire content of which is incorporated herein by reference Applying.

Technical field

This application relates to the field of communication technology, and in particular to a method and device for recording access behavior.

Background technique

At present, in the communication process, in order to avoid various risks such as uncontrolled proliferation of user data, it is necessary to record the access behavior of the visitor to the user data in order to trace the access record. For this reason, in the communication access process, on the one hand, it is necessary to ensure that each access behavior can be accurately recorded, and on the other hand, it is also necessary to ensure that the traced access record is complete and has not been damaged or modified.

At the same time, with the continuous development of blockchain technology, based on the decentralization of the blockchain and the non-tamperable characteristics of the use of distributed ledger technology, the blockchain system can be used for historical access to user data. The ability to record and preserve letters. Therefore, in the communication process, it is gradually committed to creating the traceability of access behavior based on the blockchain system.

However, there is currently no recording method based on the realization of access behavior in a decentralized blockchain network.

Summary of the invention

This application provides a method and device for recording access behavior to provide a method for recording access behavior in a decentralized blockchain network.

In the first aspect, an embodiment of the present application provides a method for recording access behavior, including:

The data recording network element uses a first key to encrypt user data; the data recording network element stores the first key in a database through a blockchain; the data recording network element receives the blockchain feedback The address of the first behavior in the smart contract of, the first behavior is used to record the behavior of the data recording network element storing the first key in the database through the blockchain; the data recording network The meta stores the encrypted user data and the address of the first behavior in a cloud platform.

Based on this solution, when user data is stored in the embodiment of the present application, the relevant information used to obtain the user data is stored in the cloud platform, database and other equipment, which effectively reduces the attack of a certain device in the system. The risk of user data leakage that cannot be traced back provides a safer method for recording access behavior based on a blockchain network.

In a possible implementation manner, the data recording network element encrypts the first key using a second key to obtain the first encrypted information, and passes the first encrypted information through the blockchain Stored in the database.

In a possible implementation, the second key is preconfigured by the database on the data recording network element; or the second key is the data recording network element from the database. Received.

In a possible implementation manner, the first behavior includes a storage address of the first key in the database.

In the second aspect, an embodiment of the present application provides a method for recording access behavior, including:

The blockchain receives the first key from the data recording network element and stores the first key in the database; the blockchain records the first behavior and the address of the first behavior through the smart contract, so The first behavior is used to record the behavior of the data recording network element storing the first key in the database through the blockchain; the blockchain feeds back the address of the first behavior to all The data recording network element.

Based on this solution, when user data is stored in the embodiment of the present application, the relevant information used to obtain the user data is stored in the cloud platform, database and other equipment, thereby effectively reducing the attack caused by a certain device in the system. , Which causes the risk of user data leakage and cannot be traced back. It provides a safer method for recording access behavior based on a blockchain network.

In a possible implementation manner, the blockchain receives first encrypted information from the data recording network element, and the first encrypted information is obtained by encrypting the first key with a second key的; The blockchain stores the first encrypted information in the database.

In a third aspect, an embodiment of the present application provides a method for recording access behavior, including:

The database receives the first key from the data recording network element through the blockchain; the database stores the first key and records the storage address; the database sends the storage address to the blockchain , So that the blockchain records the first behavior according to the storage address; wherein, the first behavior is used to record that the data recording network element stores the first key in the blockchain through the blockchain State the behavior of the database.

Based on this solution, when user data is stored in the embodiment of this application, the relevant part of the user data is stored in the cloud platform, database and other equipment, thereby effectively reducing the attack caused by a certain device in the system. The risk of user data leakage and cannot be traced back provides a safer method for recording access behavior based on a blockchain network.

In a possible implementation manner, the database receives the first encrypted information from the data recording network element through the blockchain; wherein, the first encrypted information is used to pair the first encrypted information with a second key. Obtained after a key encryption.

In a possible implementation manner, the second key is preset by the data recording network element and the database; or the second key is generated by the database.

In a possible implementation manner, after the database receives the first encrypted information from the data recording network element through the blockchain, the first key is stored, and before the storage address is recorded, the database is based on the first encrypted information. The two keys decrypt the first encrypted information to obtain the first key.

In a fourth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The access device obtains the encrypted user data from the cloud platform and the address of the first behavior in the smart contract in the blockchain. The first behavior is used to record the data recording network element transfers the first key through the blockchain. The behavior stored in the database; the access device applies to the blockchain for obtaining user data, and the request for obtaining user data carries the address of the first behavior; the access device is pairing with the blockchain through the blockchain After the identity of the access device is verified, the first key from the blockchain is received; the access device uses the first key to decrypt the encrypted user data.

Based on this solution, in the embodiment of the application, when user data is stored, the relevant part of the user data is stored in the cloud platform, database and other equipment, so that only any device in the access behavior recording system is stored Some information related to user data needs to be combined with all devices in the system to obtain user data. Therefore, it effectively reduces the risk of user data leakage due to an attack on a device in the system and cannot be traced back. A high-security method for recording access behavior based on a blockchain network is proposed.

In a possible implementation manner, the user data acquisition application includes a third key, and the third key is used by the database to encrypt the first key to obtain the second encrypted information.

In a possible implementation manner, the access device receives the second encrypted information from the blockchain.

In a possible implementation manner, the second encrypted information is obtained after encrypting the first key with a third key.

In a possible implementation manner, the access device decrypts the second encrypted information to obtain the first key.

In a possible implementation manner, the access device receives the first key from the blockchain after being verified by no less than a threshold number of nodes in the blockchain.

In a fifth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The blockchain receives an application for acquiring user data from an access device, and the application for acquiring user data carries the address of the first behavior in the smart contract, and the first behavior is used to record the data recording network element through the blockchain. The act of storing a key in the database; after the block chain determines that the access device is successfully verified, it obtains the first key from the database according to the first act; the block chain transfers the The first key is sent to the access device.

In a possible implementation, after the blockchain determines that the access device is successfully verified, it sends the result of the successful verification and the first behavior to the database; the blockchain receives the information of the database The first key.

In a possible implementation manner, after the blockchain determines that the access device is successfully verified, it sends the result of the successful verification, the first behavior, and the third key to the database.

In a possible implementation manner, the block chain obtains second encrypted information from the database according to the first behavior, and the second encrypted information is the data obtained by the database through the third key pair. The first key is encrypted; the blockchain sends the second encrypted information to the access device.

In a possible implementation manner, after the access device passes the verification of no less than a threshold number of nodes in the blockchain, the blockchain determines that the verification of the access device is successful.

In a possible implementation, before the blockchain sends the first key to the access device, the blockchain records the second behavior in the smart contract; wherein, the The second behavior is used to record the behavior of the access device to obtain user data from the blockchain; the second behavior includes the result of the blockchain verifying the access device.

In a sixth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The database receives the result of successful verification of the access device from the blockchain and the first behavior in the smart contract; the first behavior is used to record the behavior of the data recording network element storing the first key in the database through the blockchain After the database determines that the result of the successful verification is valid, it determines the first key according to the first behavior, and sends the first key to the access device via the blockchain, and the first The key is used to decrypt the encrypted user data.

In a possible implementation, the method further includes: the database further receives a third key from the blockchain, and the third key is obtained by the blockchain from the access device. Obtained in a user data application; the third key is used by the database to encrypt the first key to obtain the second encrypted information.

In a possible implementation manner, the database determines the first key according to the first behavior; the database encrypts the first key according to the third key to obtain the second encryption Information; the database sends the second encrypted information to the access device via the blockchain.

In a seventh aspect, an embodiment of the present application provides a method for recording access behavior, including:

The access device obtains the encrypted user data from the cloud platform and the address of the first behavior in the smart contract in the blockchain. The first behavior is used to record the data recording network element transfers the first key through the blockchain. The behavior of storing in the database; the access device applies to the blockchain for obtaining user data, and the request for obtaining user data carries the address of the first act and the encrypted user data block, and the user data block is all All or part of the user data; the access device receives the user data block from the blockchain after verifying the identity of the access device through the blockchain.

Based on this solution, in the embodiment of the application, when user data is stored, the relevant part of the user data is stored in the cloud platform, database and other equipment, so that only any device in the access behavior recording system is stored Some information related to user data needs to be combined with all devices in the system to obtain user data. Therefore, it effectively reduces the risk of user data leakage due to an attack on a device in the system and cannot be traced back. A high-security method for recording access behavior based on a blockchain network is proposed. At the same time, through the addition of the watermark, the embodiments of the present application can better prevent the visitor from maliciously sharing the user data with other entities after obtaining the user data.

In a possible implementation manner, the user data block received by the access device is that after the database determines the first key according to the first behavior from the blockchain, The encrypted user data block of the block chain is obtained after decryption; the first behavior includes the storage address of the first key in the database.

In a possible implementation manner, the access device receives the watermarked user data block from the blockchain.

In a possible implementation manner, the user data acquisition application includes a fourth key, and the fourth key is used by the database to encrypt the user data block to obtain the third encrypted information.

In a possible implementation manner, the access device receives the third encrypted information from the blockchain.

In a possible implementation manner, the access device receives the user data block from the blockchain after being verified by no less than a threshold number of nodes in the blockchain.

In an eighth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The blockchain receives an application for acquiring user data from an access device, and the application for acquiring user data carries the address of the first action in the smart contract and the encrypted user data block, and the first action is used to record the data that the network element passes through The behavior of the blockchain storing the first key in the database; the user data block is all or part of the user data; after the blockchain determines that the access device is successfully verified, the first The behavior and the encrypted user data block are sent to the database; the blockchain receives the user data block from the database, and sends the user data block to the access device.

In a possible implementation manner, the user data block is sent by the database after determining that the result of the successful verification of the access device sent from the blockchain is valid.

In a possible implementation manner, the blockchain receives the watermarked user data block from the database, and sends the watermarked user data block to the access device.

In a possible implementation, the method further includes: the user data acquisition application includes a fourth key, and the fourth key is used by the database to encrypt the user data block to obtain the Third encrypted information; after the blockchain determines that the access device is successfully verified, it sends the first behavior, the encrypted user data block, and the fourth key to the database.

In a possible implementation manner, the blockchain receives the third encrypted information from the database, and sends the third encrypted information to the access device.

In a possible implementation, the user data block from the database received by the block link is determined by the database according to the first behavior from the block chain Then, the encrypted user data block from the blockchain is obtained after decrypting; wherein, the first behavior includes the storage address of the first key in the database.

In a ninth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The database receives the result of successful verification of the access device from the blockchain, the first action in the smart contract, and the encrypted user data block. The act of storing the key in a database, the user data block is all or part of the user data; after the database determines that the result of the successful verification is valid, the user data block is determined according to the first act, And send the user data block to the access device through the blockchain.

In a possible implementation manner, the database determines the first key according to the first behavior; the database decrypts the encrypted user data block according to the first key, and decrypts it to obtain The user data block of is sent to the access device through the blockchain.

In a possible implementation manner, the database determines the user data block according to the first behavior;

The data block adds a watermark to the user data block, and sends the user data block with the watermark added to the access device through the blockchain.

In a possible implementation, the method further includes: the database further receives a fourth key from the blockchain, where the fourth key is obtained by the blockchain from the access device. Obtained in a user data application; the fourth key is used by the database to encrypt the user data block to obtain the third encrypted information.

In a possible implementation manner, the database determines the user data block according to the first behavior; the database encrypts the user data block according to the fourth key to obtain the third encryption Information; the database sends the third encrypted information to the access device through the blockchain.

In a tenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The access device installs the client, and sends a first application to the authorization server through the blockchain, the first application is used to grant the client the right to open the user data obtained by the access device; the access device passes through the area The block chain receives a first random number from the authorization server, the first random number is used to generate a second serial number, and the second serial number is used to verify whether the client has the right to open the user data.

Based on this solution, this embodiment further improves the ability and credibility of data access behavior recording by extending the management domain to the client of the accessing party. It can further effectively control the use of the user data after the visit, such as sending the user data visits to other visiting parties, or even the visitor's own secondary visits to the same user data, will be recorded in the blockchain Otherwise, the effective information cannot be read.

In a possible implementation manner, the first application includes the identification ID of the client; the first random number received by the access device corresponds to the identification ID of the client in a one-to-one correspondence.

In a possible implementation manner, the first application further includes a fifth key, and the fifth key is used to encrypt the first random number.

In a possible implementation manner, the access device receives fourth encrypted information from the authorization server through a blockchain, and the fourth encrypted information is that the authorization server pairs the The first random number is obtained after encryption.

In a possible implementation manner, the method further includes: the access device decrypts the fourth encrypted information according to the fifth key to obtain the first random number.

In an eleventh aspect, an embodiment of the present application provides a method for recording access behavior, including:

The block chain receives the first application sent by the access device, and the first application is used to grant the access device the right to open the user data obtained by the access device through the installed client; the block chain transfers the The first application is sent to the authorization server; the blockchain receives the first random number from the authorization server, and sends the first random number to the access device, where the first random number is used to generate A second serial number, where the second serial number is used to verify whether the client has the right to open the user data.

In a possible implementation manner, the blockchain receives the fourth encrypted information from the authorization server, and sends the fourth encrypted information to the access device, and the fourth encrypted information is the Obtained after the authorization server encrypts the first random number according to the fifth key.

In a possible implementation, the method further includes: the blockchain recording a third behavior in the smart contract; wherein, the third behavior is used to record the access device to the database Send the first application.

In a twelfth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The authorization server receives the first application sent by the access device through the blockchain, and the first application is used to grant the access device the right to open the user data obtained by the access device through the installed client; the authorization server generates First random number, and send the first random number to the access device, wherein the first random number is used to generate a second serial number, and the second serial number is used to verify that it is the client Do you have the right to open the user data.

In a possible implementation manner, the first application includes the identification ID of the client; the authorization server generates the first random number according to the identification ID of the client, and the generated first random number is the same as There is a one-to-one correspondence between the identification IDs of the clients.

In a possible implementation manner, the authorization server encrypts the first random number according to the fifth key to obtain the fourth encrypted information, and sends the fourth encrypted information to the Access the device.

In a thirteenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The data recording network element stores the user data on the cloud platform; after the data recording network element determines that the user data is successfully stored on the cloud platform, it sends the storage status of the user data to the blockchain.

In a fourteenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The blockchain receives the storage status of the user data sent by the data recording network element, and the storage status is used to instruct the data recording network element to store the user data on the cloud platform; the blockchain is determining the cloud platform After the user data is successfully stored in the user data, a user data ID is assigned to the user data; the blockchain sends the user data ID to the cloud platform.

In a fifteenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The cloud platform receives user data from the data recording network element, and stores the user data locally;

The cloud platform receives the user data ID allocated by the blockchain for the user data, and associates the user data with the user data ID.

In a sixteenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The access device obtains user data and user data ID from the cloud platform; the access device sends a second application to the blockchain, and the second application is used to request to read the user data through the client; the access device receives data from the district The first serial number sent by the block chain; the access device inputs the first serial number into the client; the access device determines that the client has the right to open the user data according to the first serial number Then, read the user data opened by the client.

In a possible implementation manner, the second application includes the identification ID of the client and the user data ID. The identification ID and the user data ID of the client are used to verify that the client has the Permission to describe user data.

In a possible implementation manner, the user data ID is also used to verify the authenticity of the user data.

In a possible implementation manner, the access device receives the first serial number from the authorization server through the blockchain after being verified by the number of nodes in the blockchain that is not less than a threshold.

In a possible implementation, the first serial number is one or more of the authorization server according to the time when the second application is received, the user data ID, or the identification ID of the client Generated.

In a possible implementation, it also includes: the access device installs the client, and sends a first application to the authorization server through the blockchain, and the first application is used to authorize the client to open the The authority of the user data; the access device receives a first random number from the authorization server through the blockchain, the first random number is used to generate a second serial number, and the second serial number is used to verify the Whether the client has the right to open the user data.

In a possible implementation manner, the access device provides the first random number to the client to generate a first random number generator; the client sends the time of the second application, the One or more of the user data ID or the identification ID of the client is used as an input parameter of the first random number generator to generate a second serial number.

In a possible implementation manner, after the client determines that the second serial number is the same as the first serial number, the access device reads the user data opened by the client.

In a possible implementation, the method further includes: the access device receives the first serial number and the second random number from the blockchain; the access device sends the first serial number and the second random number Two random numbers are input to the client; after the client has the right to open the user data according to the first serial number and the second random number, the access device reads all the files opened by the client Describe user data.

In a seventeenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The block chain receives the second application sent by the access device, the second application is used to request to read the user data through the client; the block chain sends the second application to the authorization server; the block link Receiving the first serial number sent by the authorization server, and sending the first serial number to the access device.

In a possible implementation manner, the second application includes the identification ID of the client and the user data ID. The identification ID and the user data ID of the client are used to verify that the client has the According to the authority of the user data, the user data ID is also used to verify the authenticity of the user data.

In a possible implementation, before the blockchain sends the second application to the authorization server, the method further includes:

The blockchain determines that the identification ID of the client is valid; and/or the blockchain determines that the user data ID is valid.

In a possible implementation manner, no less than a threshold number of nodes in the blockchain determines that the identification ID of the client is valid; and/or no less than a threshold number of nodes in the blockchain determines the user data ID is valid.

In a possible implementation, the blockchain finds that there is a third behavior in the smart contract according to the identification ID of the client in the second application, and the third behavior is used to record the access device A first application is sent to the database, where the first application is used to grant the access device the right to open the user data obtained by the access device through the installed client terminal.

In a possible implementation manner, the blockchain finds that there is user data corresponding to the user data ID in the cloud platform according to the user data ID in the second application.

In a possible implementation, the blockchain receives the first serial number and the second random number sent by the authorization server, and sends the first serial number and the second random number to the access device .

In a possible implementation, the method further includes: the blockchain recording a fourth behavior in the smart contract; wherein the fourth behavior is used to record the authorization of the access device to the The server sends the second application.

In an eighteenth aspect, an embodiment of the present application provides a method for recording access behavior, including:

The authorization server receives a second application from the access device through the blockchain, the second application is used to request the client to read the user data; the authorization server generates the first serial number according to the second application; The authorization server sends the first serial number to the access device through the blockchain.

In a possible implementation manner, the authorization server determines the first random number generator corresponding to the client according to the client identification ID in the second application; The application time and the user data ID are used as input parameters of the first random number generator to generate the first serial number; wherein, the first random number generator is generated by the authorization server according to the first random number of.

In a possible implementation manner, the method further includes: the authorization server generates a second random number, and sends the first serial number and the second random number to the access device through the blockchain.

In a possible implementation, the authorization server determines the first random number corresponding to the client according to the client identification ID in the second application; the authorization server determines the first random number corresponding to the client according to the first random number and the The second random number generates the second random number generator; the authorization server uses the application time of the second application and the user data ID as input parameters of the second random number generator to generate the The first serial number.

In a nineteenth aspect, an embodiment of the present application provides an access behavior recording device, which has the function of realizing the data recording network element in the foregoing embodiment. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above-mentioned functions.

Wherein, the device may be the data recording network element, or a component that can be used for the data recording network element, such as a chip or a chip system or circuit, and the device may include a transceiver and a processor. The processor may be configured to support the device to perform the corresponding functions of the above-mentioned data recording network element, and the transceiver is used to support the communication between the device and the blockchain, the database, and the like. Optionally, the device may further include a memory, which may be coupled with the processor, and stores the necessary program instructions and data of the device. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.

In a twentieth aspect, an embodiment of the present application provides an access behavior recording device, which has the function of realizing the blockchain in the foregoing embodiment. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above-mentioned functions.

Wherein, the device may be the blockchain, or a component that can be used in the blockchain, such as a chip or a chip system or circuit, and the device may include a transceiver and a processor. The processor may be configured to support the device to perform the corresponding functions of the above-mentioned blockchain, and the transceiver is used to support the communication between the device and the data recording network element, the access device, the database, the authorization server, and the like. Optionally, the device may further include a memory, which may be coupled with the processor, and stores the necessary program instructions and data of the device. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.

In the twenty-first aspect, an embodiment of the present application provides an access behavior recording device, which has the function of realizing the database in the foregoing embodiment. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above-mentioned functions.

Wherein, the device may be the database, or a component that can be used in the database, such as a chip or a chip system or circuit, and the device may include a transceiver and a processor. The processor may be configured to support the device to perform the corresponding functions of the above-mentioned database, and the transceiver is used to support the communication between the device and the data recording network element, the access device, the blockchain, the authorization server, and the like. Optionally, the device may further include a memory, which may be coupled with the processor, and stores the necessary program instructions and data of the device. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.

In the twenty-second aspect, an embodiment of the present application provides an access behavior recording device, which has the function of implementing the access device in the foregoing embodiment. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above-mentioned functions.

Wherein, the device may be the access device, or a component that can be used for the access device, such as a chip or a chip system or circuit, and the device may include a transceiver and a processor. The processor may be configured to support the device to perform the corresponding functions of the access device described above, and the transceiver is used to support the communication between the device and the data recording network element, database, blockchain, authorization server, etc. Optionally, the device may further include a memory, which may be coupled with the processor, and stores the necessary program instructions and data of the device. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.

In the twenty-second aspect, an embodiment of the present application provides an access behavior recording device, which has the function of implementing the authorization server in the foregoing embodiment. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above-mentioned functions.

Wherein, the device may be the authorization server, or a component that can be used in the authorization server, such as a chip or a chip system or circuit, and the device may include a transceiver and a processor. The processor may be configured to support the device to perform the corresponding functions of the above-mentioned authorization server, and the transceiver is used to support the communication between the device and the data recording network element, database, blockchain, access device, etc. Optionally, the device may further include a memory, which may be coupled with the processor, and stores the necessary program instructions and data of the device. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.

In the twenty-third aspect, an embodiment of the present application provides an access behavior recording device, which has the function of realizing the cloud platform in the foregoing embodiment. This function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units or modules corresponding to the above-mentioned functions.

Wherein, the device may be the cloud platform, or a component that can be used in the cloud platform, such as a chip or a chip system or circuit, and the device may include a transceiver and a processor. The processor may be configured to support the device to perform the corresponding functions of the cloud platform described above, and the transceiver is used to support the communication between the device and the data recording network element, blockchain, access equipment, and the like. Optionally, the device may further include a memory, which may be coupled with the processor, and which stores program instructions and data necessary for the device. Among them, the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.

In the twenty-fourth aspect, the embodiments of the present application also provide a data recording network element, which can be used to perform operations in any possible implementation manner of the first aspect or the thirteenth aspect. For example, the data recording network element may include modules or units for performing each operation in any possible implementation manner of the first aspect or the thirteenth aspect. For example, it includes a processing unit and a communication unit.

In the twenty-fifth aspect, the embodiments of the present application also provide a block chain, which can be used to execute the above-mentioned second, fifth, eighth, eleventh, fourteenth and Operations in any possible implementation of the seventeenth aspect. For example, the blockchain may include various operations for performing any possible implementation of the second, fifth, eighth, eleventh, fourteenth, and seventeenth aspects described above. Module or unit. For example, it includes a processing unit and a communication unit.

In the twenty-sixth aspect, the embodiments of the present application also provide a database, which can be used to perform operations in any possible implementation manner of the third aspect, the sixth aspect, and the ninth aspect. For example, the database may include modules or units for performing each operation in any possible implementation manner of the third aspect, the sixth aspect, and the ninth aspect. For example, it includes a processing unit and a communication unit.

In the twenty-seventh aspect, the embodiments of the present application also provide an access device, which can be used to execute any of the foregoing fourth, seventh, tenth, and sixteenth aspects. operate. For example, the access device may include modules or units for performing each operation in any possible implementation manner of the foregoing fourth aspect, seventh aspect, tenth aspect, and sixteenth aspect. For example, it includes a processing unit and a communication unit.

In the twenty-eighth aspect, an embodiment of the present application also provides an authorization server, which can be used to perform the operations in the twelfth aspect and any possible implementation manner of the eighteenth aspect. For example, the authorization server may include modules or units for performing each operation in any possible implementation manner of the above-mentioned twelfth aspect and the eighteenth aspect. For example, it includes a processing unit and a communication unit.

In the twenty-ninth aspect, the embodiments of the present application also provide a cloud platform, which can be used to perform operations in any possible implementation manner of the fifteenth aspect described above. For example, the cloud platform may include modules or units for performing various operations in any possible implementation manner of the fifteenth aspect described above. For example, it includes a processing unit and a communication unit.

In a thirtieth aspect, an embodiment of the present application provides a system for recording access behaviors. The system for recording access behaviors includes a data recording network element, a blockchain, and a database. Wherein, the data recording network element can be used to execute any method in the first aspect or the first aspect; the blockchain can be used to execute any method in the second aspect or the second aspect above ; The database can be used to execute any one of the above-mentioned third aspect or the third aspect;

In an optional manner of the present application, an embodiment of the present application provides a system for recording access behavior. The system for recording access behavior includes an access device, a blockchain, and a database. Wherein, the access device can be used to execute any one of the methods in the fourth aspect or the fourth aspect; the blockchain can be used to execute any one of the methods in the fifth aspect or the fifth aspect; The database can be used to execute any one of the above-mentioned sixth aspect or the sixth aspect;

In an optional manner of the present application, an embodiment of the present application provides a system for recording access behavior. The system for recording access behavior includes an access device, a blockchain, and a database. Wherein, the access device can be used to execute any one of the methods in the seventh aspect or the seventh aspect; the blockchain can be used to execute any one of the methods in the eighth aspect or the eighth aspect; The database can be used to execute any one of the above-mentioned ninth aspect or the ninth aspect;

In an optional manner of the present application, an embodiment of the present application provides a system for recording access behavior. The system for recording access behavior includes an access device, a blockchain, and an authorization server. Wherein, the access device may be used to execute any method in the tenth aspect or the tenth aspect; the blockchain may be used to execute any method in the eleventh aspect or the eleventh aspect ; The authorization server can be used to execute any one of the above-mentioned twelfth aspect or the twelfth aspect;

In an optional manner of the present application, an embodiment of the present application provides a system for recording access behavior. The system for recording access behavior includes an access device, a blockchain, and an authorization server. Wherein, the access device can be used to execute any one of the aforementioned sixteenth aspect or the sixteenth aspect; the blockchain can be used to execute any one of the aforementioned seventeenth aspect or the seventeenth aspect A method; the authorization server can be used to execute any one of the eighteenth aspect or the eighteenth aspect;

In an optional manner of the present application, an embodiment of the present application provides a system for recording access behavior, and the system for recording access behavior includes a data recording network element, a blockchain, and a cloud platform. Wherein, the data recording network element can be used to execute any one of the aforementioned thirteenth aspect or the thirteenth aspect; the blockchain can be used to execute the aforementioned fourteenth aspect or the fourteenth aspect Any method; the cloud platform can be used to execute any one of the fifteenth aspect or the fifteenth aspect described above.

In the thirty-first aspect, the present application provides a chip system including a processor. Optionally, it may further include a memory, the memory is configured to store a computer program, and the processor is configured to call and run the computer program from the memory, so that the communication device installed with the chip system executes any one of the first aspect to the eighteenth aspect; Or execute any one of the methods from the first aspect to the eighteenth aspect described above.

In a thirty-second aspect, an embodiment of the present application provides a computer storage medium. The computer storage medium stores instructions that, when run on a communication device, cause the communication device to execute any of the first to eighteenth aspects above. One side; or implement any one of the methods from the first aspect to the eighteenth aspect above.

In a thirty-third aspect, an embodiment of the present application provides a computer program product containing instructions that, when run on a communication device, causes the communication device to execute any one of the first aspect to the eighteenth aspect; or execute the foregoing Any one of the methods from the first aspect to the eighteenth aspect.

Description of the drawings

Figure 1 is a diagram of the first communication system architecture provided by this application;

FIG. 2 is a schematic flow chart of a method for recording access behaviors based on the data storage recording stage provided by this application;

Figure 3 is a diagram of the second communication system architecture provided by this application;

FIG. 4 is a schematic flowchart of the first method for recording access behaviors based on the data access recording stage provided by this application;

FIG. 5 is a schematic flowchart of the second method for recording access behaviors based on the data access recording stage provided by this application;

Figure 6 is a diagram of the third communication system architecture provided by this application;

FIG. 7 is a schematic flowchart of a client deployment method provided by this application;

Figure 8 is a diagram of the fourth communication system architecture provided by this application;

FIG. 9 is a schematic flow chart of a method for recording access behaviors based on the data storage recording stage provided by this application;

FIG. 10 is a diagram of the fifth communication system architecture provided by this application;

FIG. 11 is a schematic flow chart of the first method for recording access behavior based on data access recording stage provided by this application;

FIG. 12 is a schematic flowchart of the second method for recording access behaviors based on the data access recording stage provided by this application;

FIG. 13 is a schematic diagram of the first data recording unit provided by this application;

FIG. 14 is a schematic diagram of the second type of data recording unit provided by this application;

Figure 15 is a schematic diagram of the first blockchain provided by this application;

Figure 16 is a schematic diagram of the second type of blockchain provided by this application;

Figure 17 is a schematic diagram of the first database provided by this application;

Figure 18 is a schematic diagram of the second type of database provided by this application;

Figure 19 is a schematic diagram of the first access device provided by this application;

Figure 20 is a schematic diagram of the second type of access device provided by this application;

Figure 21 is a schematic diagram of the first authorization server provided by this application;

Figure 22 is a schematic diagram of the second authorization server provided by this application.

Detailed ways

The specific implementation process of the application embodiment will be described in detail below in conjunction with the accompanying drawings.

Among them, an existing method for tracing access behavior based on blockchain is:

The database, blockchain system, and query system are regarded as a closed system for tracing access behavior. In the access behavior tracing system, user data is stored in the database, and only the blockchain system has an interface to call the database. The blockchain system is responsible for authenticating the identity of the visitor, identifying the visitor's ability to access the accessed data, and recording the visit log. The query system serves as the only external interface of the entire access behavior tracing system, which is used to filter and translate the query request of the visiting user, and redirect the request to the blockchain system, so that the blockchain can review the user's identity through a smart contract And access authority, after confirming that the user can access the requested data, obtain the data from the database system and record every data access operation.

However, because the administrator of this closed architecture actually controls the entire system, this closed system for tracing access behavior does not have any blockchain features, and therefore does not have many security features of the blockchain.

Another existing method for tracing access behavior based on blockchain is:

The data is encrypted and stored in a public storage platform (usually in cloud storage), and the key is protected in the form of a blockchain smart contract. In addition to the management of keys, the smart contract also includes a data access control model, such as which visitors can access, and the recording mode of access behavior. Such information recorded in the smart contract is called metadata. When a visitor applies for access to certain data, he first makes a request to the blockchain network. The blockchain network calls the smart contract to identify the user's identity and access capabilities, distributes keys to the visitor, and records the visit through the state change of the contract account The visitor’s behavior.

However, in centralized management, the attacker needs to control the only server to achieve the purpose of the attack, while in the decentralized mode, the attacker only needs to control any node that records the ledger. Therefore, in this method, if the visitor only controls any blockchain verification node, let him execute the smart contract in a separate offline manner, call out the metadata to complete the purpose of accessing the data, and then the program will be rolled back to erase the record. There are huge security risks.

In order to solve the foregoing problems, the embodiments of the present application provide at least one method for recording access behaviors. The technical solutions of the embodiments of this application can be applied to various communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, and the fifth generation of the future (5th Generation, 5G) systems, such as new radio access technology (NR), and future communication systems, such as 6G systems.

Take the 5G system (also known as the new radio system) as an example. Specifically, the embodiment of this application mainly uses the method of blockchain management access capability to ensure that visitors only interact with the blockchain ledger maintenance node After that, it has the ability to access data, where the ability to access data has nothing to do with access rights. In addition, any device in the access behavior recording system described in the embodiment of the present application only stores part of information related to user data, and it is necessary to combine all devices in the system to obtain user data. Therefore, the system A certain device is attacked, which causes the risk of user data leakage and cannot be traced back. It provides a safer method for recording access behavior based on a blockchain network.

Hereinafter, some terms involved in the embodiments of the present application will be explained to facilitate understanding.

1) A smart contract is essentially a program that runs in the blockchain and is executed by events. It has the characteristics of determinism, real-time, autonomy, observability, verifiability, and decentralization, and has extensive research and applications in digital finance, big data, and the Internet of Things.

Among them, the smart contract based on the blockchain includes data reception, processing and status recording. When the contract account receives one or several input information that meets the trigger condition of the state transition, the contract action is selected according to the preset information to be automatically executed, and the current state is recorded. Therefore, as a kind of computer technology, smart contract can ensure the mandatory performance of the contract without introducing a trusted third party, and ensure the credibility and security of the contract procedure.

Further, the smart contract in the embodiment of the application includes the behavior of the data recording network element to store user data on the cloud platform, the behavior of the access device to obtain the user data application, and the data recording network element to transfer all data through the blockchain. The act of storing the first key in the database and so on.

2) Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc. It is essentially a decentralized database. Among them, the blockchain technology does not rely on additional third-party management agencies or hardware facilities, and there is no central control. In addition to the self-contained blockchain itself, through distributed accounting and storage, each node realizes information self-verification, transmission and management . Among them, decentralization is the most prominent and essential feature of blockchain.

3) Consensus mechanism refers to how to reach a consensus between nodes in the blockchain to determine the validity of a record. This is not only a means of identification, but also a means of preventing tampering. The consensus mechanism has the characteristics of "minority obeys the majority" and "everyone is equal", where "minority obeys the majority" does not completely refer to the number of nodes, but can also be computing power, number of shares, or other computer-comparable features . "Everyone is equal" means that when nodes meet the conditions, all nodes have the right to give priority to the consensus result, which may be the final consensus result after being directly recognized by other nodes.

4) Consensus result refers to the result of the implementation of the consensus mechanism by nodes in the blockchain that have reached a threshold number.

In addition, the term "at least one" in the embodiments of the present application refers to one or more, and "multiple" refers to two or more than two. "And/or" describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A , B can be singular or plural. The character "/" generally indicates that the associated objects before and after are in an "or" relationship. The following at least one item (item) or its similar expressions refer to any combination of these items, including any combination of single item (item) or plural items (item). For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .

Unless otherwise stated, the ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority, or importance of multiple objects. .

In addition, the terms "including" and "having" in the embodiments of the present application, claims and drawings are not exclusive. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, and may also include unlisted steps or modules.

In the following, the methods for recording multiple access behaviors provided by the embodiments of the present application are respectively introduced by examples.

1. The first recording method of access behavior in the embodiment of this application:

Among them, in this access behavior recording method, the main process of the embodiment of the present application includes two stages: a data storage recording phase and a data access recording phase. For different stages, the embodiments of the present application will be introduced by examples in conjunction with the accompanying drawings.

Phase one, data storage and recording phase.

To facilitate the understanding of the embodiment of the present application, firstly, the recording system of the access behavior shown in FIG. 1 is taken as an example to describe in detail the recording system applicable to the embodiment of the present application in the data storage and recording stage. As shown in FIG. 1, the recording system includes a data recording network element 100, a blockchain 101, a database 102 and a cloud platform 103.

The data recording network element 100, the data storage party, is used to securely record the user data on a platform jointly trusted by the operator alliance (for example, the cloud platform 103) after obtaining the user's contextual user data, and to check the user data through the blockchain 101 The user data is managed.

Blockchain 101 is a security implementation of distributed ledger. Blocks are used as data structures to store behavioral information. Each block contains a block body and a block header. Wherein, the block body stores the behavior content, for example, the block body stores the behavior of the data recording network element 100 storing the first key in the database through the blockchain 101. The content of the behavior may be one or more of data records, access records, or execution records according to the needs of the application scenario in an implementation of the embodiment of the present application; the block header stores the timestamp and the hash summary result of the behavior, And the necessary information to make it and the previous block form a chain structure.

The database 102 has storage and processing functions. The database 102 is used to store relevant data information in the recording system, and to update the stored data information according to the received information. In addition, the database 102 may also return corresponding information according to the received information. Exemplarily, the database in the embodiment of the present application is used to store the key used to encrypt user data in the embodiment of the present application, for example, the first key.

The cloud platform 103 has storage and processing functions. The cloud platform 103 is used to store relevant data information in the recording system, and update the stored data information according to the received information. In addition, the cloud platform 103 may also return corresponding information according to the received information. Exemplarily, the cloud platform 103 in the embodiment of the present application is used to store the encrypted user data sent by the data recording network element 100 in the embodiment of the present application.

Among them, the system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art can know that With the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems. It should be understood that FIG. 1 is only a simplified schematic diagram of an example for ease of understanding, and the recording system may also include other devices or other data recording network elements, which are not shown in FIG. 1.

Based on the recording system described in Figure 1 above, as shown in Figure 2, an embodiment of the present application provides a method for recording access behaviors based on the data storage recording stage, which specifically includes the following steps:

Step 200: The data recording network element determines a first key, and encrypts the collected user data according to the first key.

Exemplarily, in the embodiment of the present application, it is assumed that the data recording network uses the symbol M to identify the collected user data. Then, the data recording network element determines a first key, and encrypts the M according to the first key to obtain the ciphertext form C of the user data.

Step 201: The data recording network element sends the first key to the blockchain.

In an optional manner in the embodiment of the present application, in order to better ensure the security of the system, the data recording network element may encrypt the first key that needs to be transmitted. Therefore, it is possible to effectively prevent a situation in which other devices obtain the first key and obtain the user data according to the first key during the process of the recording system transmitting the first key in plain text.

Exemplarily, the data recording network element determines a second key, and encrypts the first key according to the second key to obtain the first encrypted information. Wherein, the first encryption information is the result of encryption by the first key by the second key. Then, the data recording network element sends the first encrypted information to the blockchain.

Among them, the recording network element in the embodiment of the present application may determine the second key in a variety of ways, and the details are not limited to the following.

Second key determination method 1: The data recording network element determines the key pre-configured on the data recording network element by the database as the second key.

That is to say, in the embodiment of the present application, the data recording network element and the database have agreed in advance the key used to encrypt the first key, so that when the data recording network element needs to verify the first key When the key is encrypted, the first key is directly encrypted according to the previously agreed key, that is, the second key.

Second key determination method 2: The data recording network element determines the received key sent by the database as the second key.

Exemplarily, before the data recording network element needs to send the first encrypted information, it sends the information for obtaining the second key to the database, and the database receives the information for obtaining the second key sent by the data recording network element. After the information of the second key, the locally stored second key is sent to the data recording network element.

Wherein, the database may generate the second key after receiving the information for obtaining the second key sent by the data recording network element; Before the information sent by the data recording network element to obtain the second key, it has been stored locally.

Step 202: The blockchain receives a first key from the data recording network element, and stores the first key in the database.

In an optional manner of the present application, if the block link receives the first encrypted information sent by the data recording network element, the block chain stores the first encrypted information in The database.

Step 203: The database receives the first key from the blockchain, and stores the first key safely locally.

In an optional manner in the embodiment of the present application, if the database receives the first encrypted information from the blockchain, the database encrypts the first according to a second key Information is decrypted, the first key is obtained, and then the first key is safely stored locally, and the storage address of the first key is notified to the blockchain.

In another optional manner in the embodiment of the present application, if the database receives the first encrypted information from the blockchain, the database first stores the first encrypted information in Locally, and notify the blockchain of the storage address of the first encrypted information. In the subsequent process, if the database receives an application for obtaining the first key sent by another device, at this time, the database then decrypts the first encrypted information according to the second key to obtain all the information. The first key is sending the first key to the corresponding device.

Step 204: The database notifies the blockchain of the storage address of the first key.

Step 205: The blockchain receives the storage address of the first key.

Step 206: The blockchain records the first behavior through a smart contract, and determines the address of the first behavior in the blockchain, and the first behavior is used to record that the data recording network element passes through the zone. The act of storing the first key in the database by the block chain.

Wherein, the first behavior includes the storage address of the first key in the database; or the first behavior includes the storage address of the first encrypted information in the database.

Further, the first behavior in the embodiment of the present application can be used as a security script for judging and recording the access device to access the user data in the future.

Step 207: The blockchain feeds back the address of the first behavior to the data recording network element.

In an optional manner in the embodiment of the present application, the blockchain may directly feed back the storage address of the first key to the data recording network element.

In an optional manner in the embodiment of the present application, when the first encrypted information is stored in the database, the blockchain may also directly feed back the storage address of the first encrypted information to the The data recording network element.

Step 208: The data recording network element stores the encrypted user data and the address of the first behavior in a cloud platform.

In an optional manner in the embodiment of the present application, the data recording network element stores the encrypted user data and the storage address of the first key in a cloud platform.

In an optional manner in the embodiment of the present application, if the data recording network element receives the storage address of the first encrypted information from the blockchain, the data recording network element encrypts the The subsequent user data and the storage address of the first encrypted information are stored in the cloud platform.

Phase two, data access recording phase.

In order to facilitate the understanding of the embodiment of the present application, firstly, the access behavior recording system shown in FIG. 3 is taken as an example to describe in detail the recording system applicable in the data access recording phase of the embodiment of the present application. As shown in FIG. 3, the communication system includes an access device 300, a blockchain 301, a database 302, and a cloud platform 303.

The access device 300, the data access party, is used to obtain user data. Among them, the access device in the embodiment of the application may be a network element in the core network, or a third party independent of the telecommunications network. The purpose of the access device to user data may include regulatory monitoring, or provide customization To improve user services, here, the embodiments of the present application are not limited.

The blockchain 301 is a security implementation of a distributed ledger. It uses blocks as a data structure to store behavioral information, and each block contains a block body and a block header. Among them, the block body stores the behavior content. The content of the behavior can be one or more of data records, access records, or execution records according to the needs of the application scenario in an implementation of the embodiment of the present application; the block header stores the timestamp and the hash summary result of the behavior , And the necessary information to make it and the preamble block form a chain structure.

The database 302 has storage and processing functions. The database 302 is used to store relevant data information in the recording system, and to update the stored data information according to the received information. In addition, the database 302 may also return corresponding information according to the received information. Exemplarily, the database in the embodiment of the present application is used to store the key used to encrypt user data in the embodiment of the present application, for example, the first key.

The cloud platform 303 has storage and processing functions. The cloud platform 303 is used to store relevant data information in the recording system, and update the stored data information according to the received information. In addition, the cloud platform 303 may also return corresponding information according to the received information.

Among them, the system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art can know that With the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems. It should be understood that FIG. 3 is only a simplified schematic diagram of an example for ease of understanding, and the recording system may also include other devices or other access devices, which are not shown in FIG. 3.

Based on the recording system described in FIG. 3, as shown in FIG. 4, an embodiment of the present application provides a method for recording access behaviors based on the data access recording phase, which specifically includes the following steps:

Step 400: The access device obtains the encrypted user data and the address in the blockchain of the first action in the smart contract from the cloud platform.

The smart contract is used to record the accessed behavior of the blockchain; the first behavior is used to record the behavior of the data recording network element storing the first key in the database through the blockchain.

In an optional manner in the embodiment of the present application, the access device obtains encrypted user data and the storage address of the first key in the database from a cloud platform.

Step 401: The access device applies to the blockchain for obtaining user data, and the user data obtaining application carries the address of the first action of the smart contract. Wherein, the access device in the 401 mainly seeks the arbitration and recording of this access behavior through the blockchain, that is, the first behavior in the smart contract.

Optionally, the request for obtaining user data carries a storage address of the first key in the database.

Step 402: The blockchain receives the user data acquisition application sent by the access device, and determines the first behavior according to the address of the first behavior carried in the user acquisition application.

It should be noted that when the user data acquisition application carries the storage address of the first key in the database, the step 402 may be omitted.

Step 403: The blockchain verifies the access device, and after determining that the access device is successfully verified, sends a successful verification result and the first behavior to the database.

In an optional manner of the embodiment of the present application, the blockchain determines that the access device is successfully verified after determining that the number of nodes in the blockchain that is not less than a threshold value successfully verify the access device. That is to say, in order to prevent tampering with a single node, the user data information is leaked and cannot be traced back, the embodiment of the present application may adopt a consensus mechanism, and the access device is determined only after the consensus result is that the access device is successfully verified. The verification is successful.

In an optional manner in the embodiment of the present application, the blockchain may determine whether the access device is successfully verified based on a set access policy.

Exemplarily, the access devices that comply with the access policy are all authorized access devices, and the authorization form may be direct authorization by the terminal device and/or authorization by the core network. For example, the authority grantor can authorize by signing the access device information, so that the blockchain node can determine whether the access device has passed the verification by judging the validity of the signature.

Optionally, if the block link receives the storage address of the first key sent from the access device, the block chain verifies the access device and confirms that the access device After the verification is successful, the result of the verification success and the storage address of the first key are sent to the database.

Further, if the blockchain determines that the access device verification fails, the subsequent operations are terminated.

Step 404: The database determines the first key according to the first behavior, and sends the first key to the blockchain.

Wherein, the database in the embodiment of the present application determines the first key according to the storage address of the first key in the database in the first behavior; or, if the database receives If it is the storage address of the first key sent from the blockchain, the database directly determines the first key according to the storage address of the first key.

In an optional manner in the embodiment of the present application, in order to better improve the security of information transmission, the third key is also carried in the user data acquisition application, so that the database is determining the first After the key is obtained, the first key can be encrypted according to the third key to obtain the second encrypted information, and the second encrypted information is sent to the blockchain.

In an optional manner in the embodiment of the present application, before the database executes the step 404, the database determines that the result of the successful verification is valid. Exemplarily, after the database receives the successful verification result sent by the blockchain, it can query several blockchain endorsement nodes. If it reaches 100%, it is valid.) The content of the successful verification has been recorded on the endorsing node, and the database determines that the result of the successful verification is valid; After verifying the successful result, you can spot check the endorsing nodes you trust. If the endorsing node you trust has recorded the content of the successful verification, the database determines that the successful result of the verification is valid.

Step 405: The blockchain receives the first key from the database.

In an optional manner in the embodiment of the present application, the blockchain receives the first encrypted information from the database.

Step 406: The blockchain sends the first key to the access device.

In an optional manner in the embodiment of the present application, if the block link receives the second encrypted information from the database, the block chain sends the second encrypted information to The access device.

In addition, in the embodiment of the present application, in order to effectively carry out later traceability, before the blockchain sends the first key to the access device, the blockchain records the second behavior to the smart contract Or, after the blockchain sends the first key to the access device, the second behavior is recorded in the smart contract.

Wherein, the second behavior is used to record the behavior of the access device to obtain user data application from the blockchain; the second behavior includes the result of verification of the access device by the blockchain.

Step 407: The access device receives the first key from the blockchain.

In the embodiment of the present application, if the access device receives the second encrypted information from the blockchain, the access device decrypts the second encrypted information according to the third key , To obtain the first key.

Step 408: The access device decrypts the encrypted user data according to the first key, so as to obtain the user data.

In addition, based on the recording system described in FIG. 3, as shown in FIG. 5, an embodiment of the present application also provides another method for recording access behaviors based on the data access recording phase, which specifically includes the following steps:

Step 500: The access device obtains the encrypted user data and the address in the blockchain of the first action in the smart contract from the cloud platform.

In step 501, the access device makes an application for obtaining user data to the blockchain, and the application for obtaining user data carries the address of the first action of the smart contract and the encrypted user data block.

Wherein, the user data block is part or all of the user data, and the access device in step 501 mainly seeks the arbitration and recording of this access behavior through the blockchain, that is, the smart contract The first act.

In an optional manner in the embodiment of the present application, the user obtaining application carries the storage address of the first key in the database and the encrypted user data block.

Step 502: The blockchain receives the user data acquisition application sent by the access device.

Step 503: The blockchain determines the first behavior according to the address of the first behavior carried in the obtaining user application.

It should be noted that, when the user data acquisition application carries the storage address of the first key in the database, the step 503 may be omitted.

Step 504: The blockchain verifies the access device, and after determining that the access device is successfully verified, sends the successful verification result, the first behavior, and the encrypted user data to the database Piece.

In an optional manner in the embodiment of the present application, the blockchain verifies the access device, and after determining that the access device is successfully verified, sends the result of the successful verification to the database, the first The storage address of the key in the database and the encrypted user data block.

Further, after the blockchain determines that no less than a threshold number of nodes in the blockchain successfully verify the access device, it determines that the access device is successfully verified. That is to say, in order to prevent tampering with a single node, the user data information is leaked and cannot be traced back, the embodiment of the present application may adopt a consensus mechanism, and the access device is determined only after the consensus result is that the access device is successfully verified. The verification is successful.

Wherein, for the manner in which the blockchain determines whether the access device is successfully verified, refer to step 403 above, which is a succinct description and will not be repeated here.

It should be noted that if the subsequent database does not need to verify the validity of the verification result of the blockchain to the access device, the information sent by the blockchain to the database may not include the verification success. the result of.

Step 505: The database determines the first key according to the first behavior, and decrypts the encrypted user data block according to the first key to obtain the user data block.

Wherein, the database in the embodiment of the present application determines the first key according to the storage address of the first key in the database in the first behavior.

In an optional manner in the embodiment of the present application, if the database receives the result of the successful verification sent from the blockchain, the storage address of the first key in the database And the encrypted user data block, the database directly determines the first key according to the storage address of the first key in the database.

Further, in the embodiment of the present application, in order to better ensure security, the database determines the validity of the result of the successful verification received from the blockchain before performing the step 504. On the contrary, when the database determines that the result of the successful verification received from the blockchain is invalid, it terminates subsequent operations, or sends a refusal to obtain user data to the access device through the blockchain Information.

Exemplarily, after the database receives the successful verification result sent by the blockchain, it can query several blockchain endorsement nodes. If it reaches 100%, it is valid.) The content of the successful verification has been recorded on the endorsing node, and the database determines that the result of the successful verification is valid; or, the database is After verifying the successful result, you can spot check the endorsing nodes you trust. If the endorsing node you trust has recorded the content of the successful verification, the database determines that the successful result of the verification is valid.

Step 506: The database adds a watermark to the user data block, and sends the watermarked user data block to the blockchain.

In an optional manner in the embodiment of the present application, in order to better improve the security of information transmission, the application for obtaining user data also carries the fourth key, so that the database can be based on the fourth key. The key encrypts the user data block to obtain the third encrypted information, and sends the third encrypted information to the blockchain; or,

The database may encrypt the watermarked user data block according to the fourth key to obtain the third encrypted information, and send the third encrypted information to the blockchain.

Step 507: The blockchain receives the watermarked user data block from the database.

In an optional manner in the embodiment of the present application, the blockchain receives third encrypted information from the database, where the third encrypted information is that the database pairs the The user data block is obtained after encryption; or the third encryption information is obtained after the database encrypts the watermarked user data block according to the fourth key.

Step 508: The blockchain sends the watermarked user data block to the access device.

In an optional manner in the embodiment of the present application, if the block link receives the third encrypted information from the database, the block chain sends the third encrypted information to The access device.

In addition, in the embodiment of the present application, in order to effectively carry out later traceability, before the block chain sends the watermarked user data block or the third encrypted information to the access device, the block chain The second behavior is recorded in the smart contract; or, after the blockchain sends the first key to the access device, the second behavior is recorded in the smart contract.

Step 509: The access device receives the watermarked user data block from the blockchain.

In the embodiment of the present application, if the access device receives the third encrypted information from the blockchain, the access device decrypts the third encrypted information according to the fourth key , Obtain the user data block, or obtain the user data block added with a watermark.

2. The second method of recording access behavior in the embodiment of this application:

Among them, in this access behavior recording method, the main process of the embodiment of this application includes three stages: client deployment stage, data storage recording stage, and data access recording stage. For different stages, the embodiments of this application are given examples in conjunction with the accompanying drawings. Make an introduction.

Phase one, client deployment phase.

In order to facilitate the understanding of the embodiment of the present application, first, the access behavior recording system shown in FIG. 6 is taken as an example to describe in detail the recording system applicable to the client deployment stage of the present application embodiment. As shown in FIG. 6, the communication system includes an access device 600, a client 601, a blockchain 602, and an authorization server 603.

The access device 600, the data access party, is used to obtain user data. Among them, the access device in the embodiment of the application may be a network element in the core network, or a third party independent of the telecommunications network. The purpose of the access device to user data may include regulatory monitoring, or provide customization To improve user services, here, the embodiments of the present application are not limited.

The client 601 is used to assist the access device 600 in reading user data, where the client needs to have permission to read and access the user data provided by the access device. In the embodiments of the present application, the client can be on the access device or connected to the access device. The client is not limited to be implemented purely in software, and can also be a system based on a secure hardware platform. Therefore, the embodiments of the present application are not limited.

Blockchain 602 is a security implementation of distributed ledger. Blocks are used as data structures to store behavioral information. Each block contains a block body and a block header. Among them, the block body stores the behavior content. The content of the behavior can be one or more of data records, access records, or execution records according to the needs of the application scenario in an implementation of the embodiment of the present application; the block header stores the timestamp and the hash summary result of the behavior , And the necessary information to make it and the preamble block form a chain structure.

The authorization server 603 has functions such as management and serial number generation. The authorization server in the embodiment of this application is mainly used to deploy the client's permission to read user data, and to generate a serial number, and notify the client of the serial number So as to enable the client to determine whether it has the authority to read the user data according to the serial number. The authorization server and each client realize wide synchronization in time.

Among them, the system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art can know that With the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems. It should be understood that FIG. 6 is only a simplified schematic diagram of an example for ease of understanding, and the recording system may also include other devices or other access devices, which are not shown in FIG. 6.

Based on the recording system described in FIG. 6, as shown in FIG. 7, an embodiment of the present application provides a method for recording access behaviors based on a client deployment stage, which specifically includes the following steps:

In step 700, the access device installs a client.

Step 701: The access device sends a first application to the blockchain, where the first application is used to grant the client a right to open the user data obtained by the access device.

Wherein, the first application includes the identification ID of the client.

Step 702: The blockchain receives the first application sent by the access device.

Step 703: The blockchain records a third behavior in the smart contract, where the third behavior is used to record that the access device sends the first application to the database.

Step 704: The blockchain sends the first application to the authorization server.

Step 705: The authorization server receives the first application, and generates the first random number.

Step 706: The authorization server associates the first random number with the client identification ID in the first application.

Wherein, the first random number has a one-to-one correspondence with the identification ID of the client, so that the authorization server determines the corresponding first random number according to the received identification ID of the client during the data access phase.

Step 707: The authorization server sends the first random number to the blockchain.

In an optional manner in the embodiment of this application, in order to effectively guarantee the security of the first random number and prevent the first random number from being acquired by other devices, the first application may also include a fifth key The authorization server encrypts the first random number according to the fifth key to obtain fourth encrypted information, so that the authorization server sends the fourth encrypted information to the blockchain.

Step 708: The blockchain receives the first random number from the authorization server.

In an optional manner in the embodiment of the present application, the blockchain receives the fourth encrypted information from the authorization server.

Step 709: The blockchain feeds back the first random number to the access device.

In an optional manner in the embodiment of the present application, if the block link receives the fourth encrypted information from the authorization server, the block chain feeds back the fourth encrypted information Give the access device.

Step 710: The access device receives the first random number from the blockchain.

In an optional manner in the embodiment of the present application, if the access device receives the fourth encrypted information from the blockchain, the access device pairs the cryptographic information according to the fifth key. The fourth encrypted information is decrypted to obtain the first random number.

Phase two, data storage and recording phase.

In order to facilitate the understanding of the embodiment of the present application, first, the access behavior recording system shown in FIG. 8 is taken as an example to describe in detail the recording system applicable in the data recording phase of the embodiment of the present application. As shown in FIG. 8, the communication system includes a data recording network element 800, a blockchain 801 and a cloud platform 802.

The data recording network element 800, the data storage party, is used to securely record the user data on a platform jointly trusted by the operator alliance, for example, the cloud platform 103, and manage it through the blockchain 101 after obtaining the user's contextual user data.

Blockchain 801 is a security implementation of distributed ledger. Blocks are used as a data structure to store behavioral information. Each block contains a block body and a block header. Among them, the block body stores the behavior content. The content of the behavior can be one or more of data records, access records, or execution records according to the needs of the application scenario in an implementation of the embodiment of the present application; the block header stores the timestamp and the hash summary result of the behavior , And the necessary information to make it and the preamble block form a chain structure.

The cloud platform 802 has storage and processing functions, and is used in the recording system to store relevant data information, update the stored data information according to the received information, or return corresponding information according to the received information. Among them, the cloud platform in the embodiment of the present application is used to store the encrypted user data sent by the data recording network element 800 in the embodiment of the present application.

Among them, the system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art can know that With the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems. It should be understood that FIG. 8 is only a simplified schematic diagram of an example for ease of understanding, and the recording system may further include other devices or other data recording network elements, which are not shown in FIG. 8.

Based on the recording system described in FIG. 8 above, as shown in FIG. 9, an embodiment of the present application provides a method for recording access behaviors based on the data storage recording stage, which specifically includes the following steps:

Step 900: The data recording network element stores user data in a cloud platform.

Step 901: The cloud platform receives user data from a data recording network element, and notifies the data recording network element after the user data is successfully stored locally;

Step 902: After determining that the user data is successfully stored on the cloud platform, the data recording network element sends the storage status of the user data to the blockchain.

Step 903: The blockchain receives the storage status of the user data sent by the data recording network element, where the storage status is used to instruct the data recording network element to store the user data on the cloud platform;

Step 904: After determining that the user data is successfully stored in the cloud platform, the blockchain assigns a user data ID to the user data.

Step 905: The blockchain sends the user data ID to the cloud platform.

Step 906: The cloud platform receives the user data ID allocated by the blockchain for the user data, and associates the user data with the user data ID.

Further, in the embodiments of the present application, in order to better ensure the security of the user data in the system transmission process, the user data may be encrypted and transmitted, and the content described in FIG. 2 may be specifically combined, which is not performed here. Go into details.

Phase three, data access recording phase.

In order to facilitate the understanding of the embodiment of the present application, first, the access behavior recording system shown in FIG. 10 is taken as an example to describe in detail the recording system applicable to the embodiment of the present application in the data recording stage. As shown in FIG. 10, the communication system includes an access device 1000, a client 1001, a blockchain 1002, an authorization server 1003, and a cloud platform 1004.

The access device 1000, the data access party, is used to obtain user data. Among them, the access device in the embodiment of the application may be a network element in the core network, or a third party independent of the telecommunications network. The purpose of the access device to user data may include regulatory monitoring, or provide customization To improve user services, here, the embodiments of the present application are not limited.

The client 1001 is used to assist the access device 1000 in reading user data, where the client needs to be authorized by the authorization server to be able to read and access the user data provided by the access device. In the embodiments of the present application, the client can be on the access device or connected to the access device. The client is not limited to be implemented purely in software, and can also be a system based on a secure hardware platform. Therefore, the embodiments of the present application are not limited.

Blockchain 1002 is a security implementation of distributed ledger. Blocks are used as data structures to store behavioral information. Each block contains a block body and a block header. Among them, the block body stores the behavior content. The content of the behavior can be one or more of data records, access records, or execution records according to the needs of the application scenario in an implementation of the embodiment of the present application; the block header stores the timestamp and the hash summary result of the behavior , And the necessary information to make it and the preamble block form a chain structure.

The authorization server 1003 has functions such as management and serial number generation. The authorization server in the embodiment of this application is mainly used to deploy the client's permission to read user data, and to generate a serial number, and notify the client of the serial number So as to enable the client to determine whether it has the authority to read the user data according to the serial number. The authorization server and each client realize wide synchronization in time.

The cloud platform 1004 has storage and processing functions, and is used in the recording system to store relevant data information, update the stored data information according to the received information, or return corresponding information according to the received information. Among them, the cloud platform in the embodiment of the application is used to store the encrypted user data sent by the data recording network element in the embodiment of the application.

Among them, the system architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art can know that With the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems. It should be understood that FIG. 10 is only a simplified schematic diagram of an example for ease of understanding, and the recording system may also include other devices or other access devices, which are not shown in FIG. 10.

Based on the recording system described in FIG. 10, as shown in FIG. 11, an embodiment of the present application provides a method for recording access behaviors based on the data access recording phase, which specifically includes the following steps:

Step 1100: The access device obtains user data and user data ID from the cloud platform.

Step 1101: The access device sends a second application to the blockchain, where the second application is used to request to read the user data through the client.

The second application includes the identification ID of the client and the user data ID. The identification ID and the user data ID of the client are used to verify that the client has the authority to open the user data, and the user The data ID is also used to verify the authenticity of the user data.

Step 1102: The blockchain receives the second application sent by the access device.

Step 1103: The blockchain determines that the identification ID of the client is valid; and/or determines that the user data ID is valid.

Exemplarily, the blockchain determines whether the third behavior exists in the smart contract according to the received identification ID of the client, that is, whether the access device has sent the first behavior to the database Application. If the third behavior is found according to the client ID, the client ID is valid, otherwise it is invalid.

This is because, only when the access device has sent the first application, the access device may have the authority to read the user data given by the authorization server.

Conversely, if the access device has not sent the first application, it can be determined that the access device is not authorized by the authorization server to read user data. Therefore, after the blockchain determines that the customer point identification ID is invalid, the access behavior of this time can be directly terminated, which effectively reduces the overhead of subsequent signaling and the power consumption of the system.

Exemplarily, the blockchain determines whether there is user data corresponding to the user data ID in the cloud platform according to the received user data ID. If there is corresponding user data, the user data ID is valid, otherwise it is invalid.

This is because only after the user data corresponding to the user data ID that needs to be accessed is recorded in the cloud platform, can the user data be read when the user data is determined to be authorized. Conversely, if the user data corresponding to the user data ID that needs to be accessed is not recorded in the cloud platform, the user data cannot be successfully obtained even if the reading permission is obtained. Therefore, the blockchain is determining the customer point After the identification ID is invalid, the access behavior of this time can be directly terminated, which effectively reduces the overhead of subsequent signaling and the power consumption of the system.

Further, in the embodiments of the present application, a consensus mechanism may also be applied, that is, nodes in the blockchain that are not less than a threshold number determine that the identification ID of the client is valid; and/or the number of nodes in the blockchain that is not less than the threshold number The node determines that the user data ID is valid.

Step 1104: The blockchain sends the second application to the authorization server.

Step 1105: The authorization server receives the second application from the access device through the blockchain.

Step 1106: The authorization server generates a first serial number according to the second application.

Specifically, the authorization server determines the first random number corresponding to the client identification ID according to the identification ID of the client in the second application, and then generates a first random number according to the first random number. And then use the application time of the second application and/or the user data ID as input parameters of the first random number generator to generate the first serial number.

Wherein, the first random number generator may be generated by the authorization server according to the first random number in advance, and the authorization server directly determines the identification ID of the client according to the second application The first random number generator.

Step 1107: The authorization server sends the first serial number to the blockchain.

Step 1108: The blockchain receives the first serial number sent by the authorization server, and sends the first serial number to the access device.

In addition, in the embodiment of this application, in order to effectively carry out later traceability, before the block chain sends the first serial number to the access device, the block chain records the fourth behavior in the smart contract Or, after the blockchain sends the first serial number to the access device, the blockchain records the fourth behavior in the smart contract.

Wherein, the fourth behavior is used to record that the access device sends the second application to the authorization server.

Step 1109: The access device receives the first serial number from the blockchain, and inputs the first serial number into the client.

Step 1110: The access device reads the user data opened by the client after the client determines that the client has the right to open the user data according to the first serial number.

Specifically, the client generates a second serial number, and after determining that the generated second serial number is the same as the first serial number, opens the user data, and the access device reads the opened user data by the client User data.

Wherein, the client generates a first random number generator according to the first random number received in the deployment phase, and then uses the application time of the second application and/or the user data ID as the first random number The input parameters of the number generator are used to generate the second serial number, so as to compare whether the first serial number and the second serial number are the same.

Further, in the embodiment of the present application, in order to better guarantee the security of the first random number and/or the first sequence number during the transmission process of the system, the first random number and/or the first sequence number may be A serial number is encrypted and transmitted, which can be specifically combined with the content described in Figure 2 above, and will not be repeated here.

In addition, based on the recording system described in FIG. 10, as shown in FIG. 12, an embodiment of the present application also provides another method for recording access behavior based on the data access recording phase, which specifically includes the following steps:

Step 1200: The access device obtains user data and user data ID from the cloud platform.

Step 1201: The access device sends a second application to the blockchain, where the second application is used to request to read the user data through the client.

Step 1202: The blockchain receives the second application sent by the access device.

Step 1203: The blockchain determines that the identification ID of the client is valid; and/or determines that the user data ID is valid.

For details, please refer to step 1103 above, which will not be repeated here.

Step 1204: The blockchain sends the second application to the authorization server.

Step 1205: The authorization server receives the second application from the access device through the blockchain.

Step 1206, the authorization server generates a second random number, and the authorization server generates a first serial number according to the second application.

Specifically, the authorization server determines the first random number corresponding to the client identification ID according to the identification ID of the client in the second application, and then, according to the first random number and the second random number The number generates a first random number generator, and then uses the application time of the second application and/or the user data ID as input parameters of the first random number generator to generate the first serial number.

Step 1207: The authorization server sends the first serial number and the second random number to the blockchain.

Step 1208: The blockchain receives the first serial number and the second random number sent by the authorization server, and sends the first serial number and the second random number to the access device.

For details, please refer to step 1108 above, which will not be repeated here.

Step 1209: The access device receives the first serial number and the second random number from the blockchain, and inputs the first serial number and the second random number to the client.

In step 1210, the access device reads the user data opened by the client after the client has the right to open the user data according to the first serial number.

Specifically, the client uses the application time of the second application and/or the user data ID as input parameters of the first random number generator to generate the second serial number. The client opens the user data after determining that the generated second serial number is the same as the first serial number. The access device reads the user data opened by the client.

Further, in the embodiment of the present application, in order to better ensure the security of the second random number and/or the first sequence number during system transmission, the first random number and/or the first sequence number may be A serial number is encrypted and transmitted, which can be specifically combined with the content described in Figure 2 above, and will not be repeated here.

Through the above introduction of the solution of the present application, it can be understood that, in order to realize the above functions, the above-mentioned realization devices include hardware structures and/or software modules corresponding to the respective functions. Those skilled in the art should easily realize that in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Based on the above embodiment, as shown in FIG. 13, a data recording network element of the present application includes a processor 1300, a memory 1301, and a communication interface 1302.

The processor 1300 is responsible for managing the bus architecture and general processing, and the memory 1301 may store data used by the processor 1300 when performing operations. The transceiver communication interface 1302 is used to receive and send data under the control of the processor 1300 for data communication with the memory 1301.

The processor 1300 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1300 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The memory 1301 may include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other various media that can store program codes.

The processor 1300, the memory 1301, and the communication interface 1302 are connected to each other. Optionally, the processor 1300, the memory 1301, and the communication interface 1302 may be connected to each other through a bus 1303; the bus 1303 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used in FIG. 13, but it does not mean that there is only one bus or one type of bus.

Specifically, the processor 1300 is configured to read the program in the memory 1301 and execute the method procedure executed by the data recording network element in S200-S207 as shown in FIG. 2; or execute S900 as shown in FIG. -The process of the method executed by the data recording network element described in S906.

As shown in FIG. 14, the present application provides a data recording network element. The data recording network element includes: a processing unit 1400 and a communication unit 1401;

In an optional manner in the embodiment of the present application, the processing unit 1400 and the communication unit 1401 are configured to execute the following content:

The processing unit 1400 is configured to use a first key to encrypt user data; store the first key in a database through a blockchain;

The communication unit 1401 is configured to receive the address of the first behavior in the smart contract fed back by the blockchain, and the first behavior is used to record that the data recording network element transfers the first behavior through the blockchain. The act of storing the key in the database;

The processing unit 1400 is configured to store the encrypted user data and the address of the first behavior in a cloud platform.

The processing unit 1400 is configured to store user data on a cloud platform;

The communication unit 1401 is configured to send the storage status of the user data to the blockchain after determining that the user data is successfully stored on the cloud platform.

Based on the above embodiment, as shown in FIG. 15, a blockchain of the present application includes a processor 1500, a memory 1501, and a communication interface 1502.

The processor 1500 is responsible for managing the bus architecture and general processing, and the memory 1501 can store data used by the processor 1500 when performing operations. The transceiver communication interface 1502 is used to receive and send data under the control of the processor 1500 for data communication with the memory 1501.

The processor 1500 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1300 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The memory 1501 may include: a U disk, a mobile hard disk, a read-only memory (read-only memory, ROM), a random access memory (random access memory, RAM), a magnetic disk or an optical disk and other media that can store program codes.

The processor 1500, the memory 1501, and the communication interface 1502 are connected to each other. Optionally, the processor 1500, the memory 1501, and the communication interface 1502 may be connected to each other through a bus 1503; the bus 1503 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 15 to represent it, but it does not mean that there is only one bus or one type of bus.

Specifically, the processor 1500 is configured to read the program in the memory 1501 and execute the method flow of the blockchain execution in S200-S207 as shown in FIG. 2; or execute S400- as shown in FIG. The process of the method executed by the blockchain in S408; or the process of the method executed by the blockchain in S500-S508 as shown in FIG. 5; or the block in S700-S710 as shown in FIG. 7 The method flow of chain execution; or the method flow of blockchain execution described in S900-S906 shown in FIG. 9; or the method flow of blockchain execution described in S1100-S1111 shown in FIG. 11; Or execute the method flow of the blockchain execution in S1200-S1212 as shown in FIG. 12.

As shown in FIG. 16, the present application provides a blockchain, which includes: a processing unit 1600 and a communication unit 1601;

In an optional manner in the embodiment of the present application, the processing unit 1600 and the communication unit 1601 are configured to execute the following content:

The communication unit is configured to receive a first key from a data recording network element, and store the first key in a database;

The processing unit 1600 is configured to record a first behavior and an address of the first behavior through a smart contract, and the first behavior is used to record that the data recording network element transfers the first secret through the blockchain The act of storing the key in the database;

The communication unit 1601 is configured to feed back the address of the first behavior to the data recording network element.

The communication unit 1601 is configured to receive an application for acquiring user data from an access device; the address of the first action in the smart contract carried in the application for acquiring user data; The act of storing the first key in the database by the blockchain;

The processing unit 1600 is configured to obtain the first key from the database according to the first behavior after determining that the access device is successfully authenticated;

The communication unit 1601 is configured to send the first key to the access device.

The communication unit 1601 is configured to receive an application for acquiring user data from an access device, and the application for acquiring user data carries the address of the first behavior in the smart contract and the encrypted user data block; the first behavior is used for recording The behavior of the data recording network element storing the first key in the database through the blockchain; the user data block is all or part of the user data;

The processing unit 1600 is configured to determine the first behavior according to the address of the first behavior;

The communication unit 1601 is configured to send the first behavior and the encrypted user data block to the database after determining that the access device is successfully authenticated; receive the user data block from the database, And send the user data block to the access device.

The communication unit 1601 is configured to receive a first application sent by an access device, where the first application is used to grant the access device the right to open the user data obtained by the access device through a client installed;

The processing unit 1600 is configured to determine that the access device passes verification;

The communication unit 1601 is configured to send the first application to an authorization server; receive a first random number from the authorization server, and send the first random number to the access device, wherein the first random number A random number is used to generate a second serial number, and the second serial number is used to verify whether the client has the right to open the user data.

The communication unit 1601 is configured to receive a storage state of user data sent by a data recording network element, where the storage state is used to instruct the data recording network element to store the user data in a cloud platform;

The processing unit 1600 is configured to allocate a user data ID to the user data after determining that the user data is successfully stored in the cloud platform;

The communication unit 1601 is configured to send the user data ID to the cloud platform.

The communication unit 1601 is configured to receive a second application sent by an access device, where the second application is used to request to read the user data through the client;

The communication unit 1601 is configured to send the second application to the authorization server; receive the first serial number sent by the authorization server, and send the first serial number to the access device.

Based on the above embodiment, as shown in FIG. 17, a database of the present application includes a processor 1700, a memory 1701, and a communication interface 1702.

The processor 1700 is responsible for managing the bus architecture and general processing, and the memory 1701 can store data used by the processor 1700 when performing operations. The transceiver communication interface 1702 is used for receiving and sending data under the control of the processor 1700 for data communication with the memory 1701.

The processor 1700 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1700 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The memory 1701 may include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other various media that can store program codes.

The processor 1700, the memory 1701, and the communication interface 1702 are connected to each other. Optionally, the processor 1700, the memory 1701, and the communication interface 1702 may be connected to each other through a bus 1703; the bus 1703 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 17, but it does not mean that there is only one bus or one type of bus.

Specifically, the processor 1700 is configured to read the program in the memory 1701 and execute the method flow of the database execution in S200-S207 as shown in FIG. 2; or execute the method in S400-S408 as shown in FIG. The process of the method executed by the database; or the process of the method executed by the database in S500-S508 as shown in FIG. 5.

As shown in FIG. 18, the present application provides a database, which includes: a processing unit 1800 and a communication unit 1801;

In an optional manner in the embodiment of the present application, the processing unit 1800 and the communication unit 1801 are configured to execute the following content:

The communication unit 1801 is configured to receive the first key from the data recording network element through the blockchain;

The processing unit 1800 is configured to store the first key and record the storage address;

The communication unit 1801 is configured to send the storage address to the blockchain, so that the blockchain records the first behavior according to the storage address;

Wherein, the first behavior is used to record the behavior of the data recording network element storing the first key in the database through the blockchain.

The communication unit 1801 is configured to receive the successful verification result and the first behavior in the smart contract sent by the blockchain after determining that the access device is successfully verified; the first behavior is used to record that the data recording network element passes through the zone The act of storing the first key in the database by the block chain;

The processing unit 1800 is configured to determine a first key according to the first behavior after determining that the result of the successful verification is valid;

The communication unit 1801 is configured to send the first key to the access device through the blockchain;

The first key is used to decrypt the encrypted user data obtained by the access device from the cloud platform.

The communication unit 1801 is configured to receive the successful verification result, the first behavior in the smart contract, and the encrypted user data block sent by the blockchain after determining that the access device is successfully verified; The encrypted user data block is obtained by the block chain from the received user data acquisition application sent by the access device, and the first line is used to record the data recording network element through the block chain. The act of storing the key in the database; the user data block is all or part of the user data;

The processing unit 1800 is configured to determine the user data block according to the first behavior after determining that the result of the successful verification is valid;

The communication unit 1801 is configured to send the user data block to the access device through the blockchain.

Based on the above embodiment, as shown in FIG. 19, an access device of the present application includes a processor 1900, a memory 1901, and a communication interface 1902.

The processor 1900 is responsible for managing the bus architecture and general processing, and the memory 1901 can store data used by the processor 1900 when performing operations. The transceiver communication interface 1902 is used to receive and send data under the control of the processor 1900 for data communication with the memory 1901.

The processor 1900 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1900 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The memory 1901 may include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes.

The processor 1900, the memory 1901, and the communication interface 1902 are connected to each other. Optionally, the processor 1900, the memory 1901, and the communication interface 1902 may be connected to each other through a bus 1903; the bus 1903 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used to represent in FIG. 19, but it does not mean that there is only one bus or one type of bus.

Specifically, the processor 1900 is configured to read the program in the memory 1901 and execute the method procedure executed by the access device in S400-S408 as shown in FIG. 4; or execute S500-S508 as shown in FIG. The process of the method executed by the access device described in FIG. 7; or the process of the method executed by the access device described in S700-S710 shown in FIG. 7; or the method executed by the access device described in S1100-S1111 shown in FIG. Flow; or execute the method flow executed by the access device described in S1200-S1212 as shown in FIG. 12.

As shown in FIG. 20, the present application provides an access device, the access device includes: a processing unit 2000 and a communication unit 2001;

In an optional manner in the embodiment of the present application, the processing unit 2000 and the communication unit 2001 are configured to execute the following content:

The communication unit 2001 is used to obtain the encrypted user data and the address in the blockchain of the first behavior in the smart contract from the cloud platform, and the first behavior is used to record the data recording network element passing the block The act of storing the first key in the database by the chain;

The processing unit 2000 is configured to apply to the blockchain for obtaining user data, and the user data obtaining request carries the address of the first action;

The communication unit 2001 is configured to receive the first key from the blockchain after verifying the identity of the access device through the blockchain;

The processing unit 2000 is configured to use the first key to decrypt the encrypted user data.

The processing unit 2000 is configured to obtain the encrypted user data and the address in the blockchain of the first behavior in the smart contract from the cloud platform, and the first behavior is used to record the data recording network element passing the block The act of storing the first key in the database by the chain;

The communication unit 2001 is configured to send an application for acquiring user data to the blockchain, and the application for acquiring user data carries the address of the first action and an encrypted user data block, and the user data block is the user All or part of the data; after verifying the identity of the access device by the blockchain, receiving the user data block from the blockchain.

The processing unit 2000 is configured to install a client and send a first application to the authorization server through the blockchain, the first application being used to grant the client the right to open the user data obtained by the access device;

The communication unit 2001 is configured to receive a first random number from the authorization server via a blockchain, the first random number is used to generate a second serial number, and the second serial number is used to verify the client Whether the terminal has the right to open the user data.

The processing unit 2000 is configured to obtain user data and user data ID from a cloud platform;

The communication unit 2001 is configured to send a second application to the blockchain, where the second application is used to request the client to read the user data; receive the first serial number sent from the blockchain;

The processing unit 2000 is configured to input the first serial number into the client; after the client determines the right to open the user data according to the first serial number, read the user data opened by the client The user data.

Based on the above embodiment, as shown in FIG. 21, an authorization server of the present application includes a processor 2100, a memory 2101, and a communication interface 2102.

The processor 2100 is responsible for managing the bus architecture and general processing, and the memory 2101 can store data used by the processor 2100 when performing operations. The transceiver communication interface 2102 is used to receive and send data under the control of the processor 2100 for data communication with the memory 2101.

The processor 2100 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 2100 may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The memory 2101 may include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes.

The processor 2100, the memory 2101, and the communication interface 2102 are connected to each other. Optionally, the processor 2100, the memory 2101, and the communication interface 2102 may be connected to each other through a bus 2103; the bus 2103 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 21 to represent it, but it does not mean that there is only one bus or one type of bus.

Specifically, the processor 2100 is configured to read the program in the memory 2101 and execute the method flow executed by the authorization server in S700-S710 as shown in FIG. 7; or execute S1100-S1111 as shown in FIG. The method flow executed by the authorization server in the above; or the method flow executed by the authorization server in S1200-S1212 shown in FIG. 12 is executed.

As shown in FIG. 22, this application provides an authorization server. The authorization server includes: a processing unit 2200 and a communication unit 2201;

In an optional manner in the embodiment of the present application, the processing unit 2200 and the communication unit 2201 are configured to execute the following content:

The communication unit 2201 is configured to receive a first application sent by an access device through the blockchain, and the first application is used to grant the access device the right to open the user data obtained by the access device through the installed client terminal ；

The processing unit 2200 is configured to generate a first random number;

The communication unit 2201 is configured to send the first random number to the access device, where the first random number is used for the client to verify whether it has the right to open the user data.

The processing unit 2200 is configured to obtain user data and user data ID from the cloud platform;

The communication unit 2201 is configured to send a second application to the blockchain, and the second application is used to request to read the user data through the client; and receive the first serial number sent from the blockchain;

The processing unit 2200 is configured to input the first serial number into the client; after the client determines the right to open the user data according to the first serial number, read the client opened The user data.

The program product can use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. Modifications of the readable storage medium. Examples (non-exhaustive list) in one implementation of the embodiments of the present application include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only Memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

The program product for recording access behavior according to the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may run on a server device. However, the program product of this application is not limited to this. In this document, the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with information transmission, devices, or devices.

The readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with a periodic network action system, apparatus, or device.

The program code contained on the readable medium can be transmitted by any suitable medium, including, but not limited to, wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

The program code used to perform the operations of this application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language-such as "C" language or similar programming language. The program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device.

The method for recording access behaviors in the embodiments of the present application also provides a storage medium readable by a computing device, that is, the content is not lost after a power failure. The storage medium stores a software program, including program code. When the program code runs on a computing device, the software program can implement any of the above embodiments of the present application when it is read and executed by one or more processors. The scheme of the recording of the access behavior.

The foregoing describes the present application with reference to block diagrams and/or flowcharts illustrating methods, devices (systems) and/or computer program products according to embodiments of the present application. It should be understood that one block of the block diagram and/or flowchart diagram and a combination of the blocks in the block diagram and/or flowchart diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, and/or other programmable data processing devices to produce a machine, so that the instructions executed via the computer processor and/or other programmable data processing device are created for A method of implementing the functions/actions specified in the block diagrams and/or flowchart blocks.

Correspondingly, hardware and/or software (including firmware, resident software, microcode, etc.) can also be used to implement this application. Furthermore, this application may take the form of a computer program product on a computer-usable or computer-readable storage medium, which has a computer-usable or computer-readable program code implemented in the medium to be used or used by the instruction execution system. Used in conjunction with the instruction execution system. In the context of this application, a computer-usable or computer-readable medium can be any medium that can contain, store, communicate, transmit, or transmit a program for use by an instruction execution system, apparatus, or device, or in combination with an instruction execution system, Device or equipment use.

Although the application has been described in combination with specific features and embodiments, it is obvious that various modifications and combinations can be made without departing from the spirit and scope of the application. Correspondingly, the specification and drawings are merely exemplary descriptions of the application as defined by the appended claims, and are deemed to cover any and all modifications, changes, combinations or equivalents within the scope of the application. Obviously, those skilled in the art can make various changes and modifications to the application without departing from the scope of the application. In this way, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application also intends to include these modifications and variations.

Claims

A method for recording access behavior, which is characterized in that it includes:

The access device obtains the encrypted user data from the cloud platform and the address of the first action in the smart contract in the blockchain, and the first action is used to record the data recording network element transfers the first key through the blockchain The behavior of storing to the database;

The access device sends an application for obtaining user data to the blockchain, and the application for obtaining user data carries the address of the first behavior;

The access device receives the first key from the blockchain after verifying the identity of the access device through the blockchain;

The access device uses the first key to decrypt the encrypted user data.
The method according to claim 1, wherein the application for obtaining user data includes a third key, and the third key is used by the database to encrypt the first key to obtain the first key. 2. Encrypted information.
The method of claim 2, wherein the access device receiving the first key from the blockchain comprises: the access device receiving second encrypted information from the blockchain ；

The method further includes: the access device decrypts the second encrypted information to obtain the first key.
The method according to any one of claims 1 to 3, wherein after the access device passes the verification of the blockchain, receiving the first key from the blockchain comprises:

The access device receives the first key from the blockchain after passing the verification of no less than a threshold number of nodes in the blockchain.
A method for recording access behavior, which is characterized in that it includes:

The blockchain receives an application for acquiring user data from an access device, and the application for acquiring user data carries the address of the first behavior in the smart contract, and the first behavior is used to record the data recording network element through the blockchain. The act of storing a key in the database;

After the blockchain determines that the access device is successfully verified, obtain the first key from the database according to the first behavior;

The blockchain sends the first key to the access device.
The method of claim 5, wherein after the blockchain determines that the access device is successfully verified, obtaining the first key from the database according to the first behavior comprises:

After the blockchain determines that the access device is successfully verified, it sends the result of the successful verification and the first behavior to the database;

The blockchain receives the first key of the database.
The method according to claim 6, wherein the application for obtaining user data includes a third key, and the third key is used by the database to encrypt the first key to obtain the first key. 2. Encrypted information.
The method according to claim 7, wherein after the blockchain determines that the access device is successfully verified, sending the result of the successful verification and the first behavior to the database, comprising:

After the blockchain determines that the access device is successfully verified, it sends the result of the successful verification, the first behavior, and the third key to the database.
The method of claim 8, wherein the blockchain obtains the first key from the database according to the first behavior, and sends the first key to the access device ,include:

The blockchain obtains second encrypted information from the database according to the first behavior, and the second encrypted information is obtained after the database encrypts the first key with the third key ；

The blockchain sends the second encrypted information to the access device.
The method according to any one of claims 5 to 9, wherein the blockchain determining that the access device is successfully verified includes:

After the access device passes the verification of no less than a threshold number of nodes in the blockchain, the blockchain determines that the access device is successfully verified.
The method according to any one of claims 5 to 10, wherein before the blockchain sends the first key to the access device, the method further comprises:

The block chain records the second behavior in the smart contract;

Wherein, the second behavior is used to record the behavior of the access device to obtain user data application from the blockchain; the second behavior includes the result of verification of the access device by the blockchain.
A method for recording access behavior, which is characterized in that it includes:

The access device obtains the encrypted user data from the cloud platform and the address of the first action in the smart contract in the blockchain, and the first action is used to record the data recording network element transfers the first key through the blockchain The behavior of storing to the database;

The access device sends an application for obtaining user data to the blockchain, and the application for obtaining user data carries the address of the first action and an encrypted user data block, and the user data block is all or all of the user data. part;

The access device receives the user data block from the blockchain after verifying the identity of the access device through the blockchain.
The method according to claim 12, wherein the receiving of the user data block from the blockchain by the access device comprises:

The access device receives the watermarked user data block from the blockchain.
The method according to claim 12 or 13, wherein the access device receives the user data block from the blockchain after verifying the identity of the access device through the blockchain, include:

The access device receives the user data block from the blockchain after passing the verification of no less than a threshold number of nodes in the blockchain.
A method for recording access behavior, which is characterized in that it includes:

The access device obtains user data and user data ID from the cloud platform;

The access device sends a second application to the blockchain, where the second application is used to request to read the user data through the client;

The access device receives the first serial number sent from the blockchain;

The access device inputs the first serial number into the client;

The access device reads the user data opened by the client after determining that the client has the right to open the user data according to the first serial number.
The method according to claim 15, characterized in that it further comprises:

The access device installs the client, and sends a first application to the authorization server through the blockchain, where the first application is used to grant the client the right to open the user data;

The access device receives a first random number from the authorization server through the blockchain, the first random number is used to generate a second serial number, and the second serial number is used to verify whether the client has the right Open the user data.
The method of claim 16, further comprising:

The access device provides the first random number to the client to generate a first random number generator;

The second serial number is after the client enters one or more of the time of the second application, the user data ID, or the identification ID of the client into the first random number generator Generated.
The method of claim 17, wherein the access device reads the user data opened by the client after the client has the right to open the user data according to the first serial number ,include:

After the client determines that the second serial number is the same as the first serial number, the access device reads the user data opened by the client.
A method for recording access behavior, which is characterized in that it includes:

The data recording network element uses the first key to encrypt user data;

The data recording network element stores the first key in a database through a blockchain;

The data recording network element receives the address of the first behavior in the smart contract fed back by the blockchain, and the first behavior is used to record that the data recording network element transfers the first key through the blockchain The act of storing in the database;

The data recording network element stores the encrypted user data and the address of the first behavior in a cloud platform.
The method of claim 19, wherein the data recording network element stores the first key in a database via a blockchain, comprising:

The data recording network element encrypts the first key using a second key to obtain first encrypted information, and stores the first encrypted information in the database through the blockchain.
An access behavior recording device, which is characterized by comprising: a processing unit and a communication unit;

The communication unit is used to obtain encrypted user data from the cloud platform and the address of the first behavior in the smart contract in the blockchain, and the first behavior is used to record the data recording network element through the blockchain The act of storing the first key in the database;

The processing unit is configured to send an application for acquiring user data to the blockchain, and the application for acquiring user data carries the address of the first action;

The communication unit is configured to receive the first key from the blockchain after verifying the identity of the access device through the blockchain;

The processing unit is configured to use the first key to decrypt the encrypted user data.
The device according to claim 21, wherein the user data acquisition application includes a third key, and the third key is used by the database to encrypt the first key to obtain the first key. 2. Encrypted information.
The device according to claim 22, wherein the communication unit is specifically configured to:

Receiving second encrypted information from the blockchain;

The processing unit is also used for:

Decrypt the second encrypted information to obtain the first key.
The device according to any one of claims 21 to 23, wherein the communication unit is configured to:

After passing verification of no less than a threshold number of nodes in the blockchain, receiving the first key from the blockchain.
An access behavior recording device, which is characterized by comprising: a processing unit and a communication unit;

The communication unit is configured to receive an application for acquiring user data from an access device, the address of the first behavior in the smart contract carried in the request for acquiring user data, and the first behavior is used to record that the data recording network element passes through the The act of storing the first key in the database by the blockchain;

The processing unit is configured to obtain the first key from the database according to the first behavior after determining that the access device is successfully authenticated;

The communication unit is configured to send the first key to the access device.
The device according to claim 25, wherein the communication unit is specifically configured to:

After determining that the access device is successfully verified, sending the result of the successful verification and the first behavior to the database;

The first key of the database is received.
The device according to claim 26, wherein the application for obtaining user data includes a third key, and the third key is used by the database to encrypt the first key to obtain the first key. 2. Encrypted information.
The device according to claim 27, wherein the communication unit is specifically configured to:

After it is determined that the access device is successfully verified, the result of the successful verification, the first behavior, and the third key are sent to the database.
The device according to claim 28, wherein the processing unit is specifically configured to:

Acquiring second encrypted information from the database according to the first behavior, where the second encrypted information is obtained by the database after encrypting the first key with the third key;

The communication unit is specifically used for:

Sending the second encrypted information to the access device.
The device according to any one of claims 25-29, wherein the processing unit is specifically configured to:

It is determined that the number of nodes that is not less than the threshold value successfully verifies the access device.
The device according to any one of claims 25 to 30, wherein the processing unit is further configured to:

Record the second behavior in the smart contract;

Wherein, the second behavior is used to record the behavior of the access device to obtain user data application from the blockchain; the second behavior includes the result of verification of the access device by the blockchain.
An access behavior recording device, which is characterized by comprising: a processing unit and a communication unit;

The processing unit is configured to obtain encrypted user data and the address of the first behavior in the smart contract in the blockchain from the cloud platform, and the first behavior is used to record the data recording network element through the blockchain The act of storing the first key in the database;

The communication unit is configured to send an application for obtaining user data to the blockchain, and the application for obtaining user data carries the address of the first action and an encrypted user data block, and the user data block is the user data All or part of; after the identity of the access device is verified by the blockchain, the user data block from the blockchain is received.
The device according to claim 32, wherein the communication unit is specifically configured to:

Receiving the watermarked user data block from the blockchain.
The device according to claim 32 or 33, wherein the communication unit is specifically configured to:

After passing verification of no less than a threshold number of nodes in the blockchain, receiving the user data block from the blockchain.
An access behavior recording device, which is characterized by comprising: a processing unit and a communication unit;

The processing unit is used to obtain user data and user data ID from a cloud platform;

The communication unit is configured to send a second application to the blockchain, where the second application is used to request to read the user data through the client;

Receive the first serial number sent from the blockchain;

The processing unit is configured to input the first serial number into the client;

After the client determines that it has the right to open the user data according to the first serial number, read the user data opened by the client.
The device according to claim 35, wherein the processing unit was previously used for:

Install the client;

The communication unit is also used for:

Sending a first application to the authorization server through the blockchain, where the first application is used to grant the client the right to open the user data;

Receive a first random number from the authorization server through the blockchain, the first random number is used to generate a second serial number, and the second serial number is used to verify whether the client has the right to open the user data.
The device according to claim 36, wherein the processing unit is further configured to:

Providing the first random number to the client to generate a first random number generator;

The second serial number is after the client enters one or more of the time of the second application, the user data ID, or the identification ID of the client into the first random number generator Generated.
The device according to claim 37, wherein the processing unit is specifically configured to:

After the client determines that the generated second serial number is the same as the first serial number, read the user data opened by the client.
An access behavior recording device, which is characterized by comprising: a processing unit and a communication unit;

The processing unit is configured to use a first key to encrypt user data; store the first key in a database through a blockchain;

The communication unit is configured to receive the address of the first behavior in the smart contract fed back by the blockchain, and the first behavior is used to record that the data recording network element transfers the first secret through the blockchain The act of storing the key in the database;

The processing unit is configured to store the encrypted user data and the address of the first behavior in a cloud platform.
The device according to claim 39, wherein the processing unit is specifically configured to:

Determine the second key; use the second key to encrypt the first key to obtain first encrypted information, and store the first encrypted information in the database through the blockchain.
An access behavior recording device, which is characterized by comprising: at least one processor; wherein the at least one processor is used to couple with a memory, read computer instructions stored in the memory, and execute according to the computer instructions The method step according to any one of claims 1 to 4; or the method step according to any one of claims 5 to 11; or the method step according to any one of claims 12 to 14; or Perform the method steps according to any one of claims 15-18; or perform the method steps according to any one of claims 19-20.
A recording device for access behavior, characterized in that it is used to perform any of the methods described in 1 to 4; or used to perform any of the methods described in 5 to 11; or used to perform any of 12 to 14 The method described in 1; or used to perform the method described in any one of 15-18; or used to perform the method described in any one of 19-20.
A recording system for access behavior, characterized in that it comprises the device according to any one of claims 21-24 and the device according to any one of claims 25-31.
An access behavior recording system, characterized in that it comprises the device according to any one of claims 32-34 or 35-38 or 39-40.
A computer-readable storage medium, characterized by comprising computer instructions, when the computer instructions run on a computer, cause the computer to execute the method steps according to any one of claims 1 to 4; or execute as claimed The method step according to any one of 5 to 11; or the method step according to any one of claims 12 to 14; or the method step according to any one of claims 15 to 18; or the method step according to any one of claims 15-18; or The method steps described in any of 19-20 are required.
A computer program product, characterized in that the computer program product includes computer instructions, when the computer instructions are executed on a computer, the computer is caused to execute the method steps according to any one of claims 1 to 4; or The method step according to any one of claims 5-11; or the method step according to any one of claims 12-14; or the method step according to any one of claims 15-18; or Perform the method steps according to any one of claims 19-20.