WO2022252912A1 - 一种用户数据管理方法以及相关设备 - Google Patents

一种用户数据管理方法以及相关设备 Download PDF

Info

Publication number
WO2022252912A1
WO2022252912A1 PCT/CN2022/091117 CN2022091117W WO2022252912A1 WO 2022252912 A1 WO2022252912 A1 WO 2022252912A1 CN 2022091117 W CN2022091117 W CN 2022091117W WO 2022252912 A1 WO2022252912 A1 WO 2022252912A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
request
storage device
data storage
access
Prior art date
Application number
PCT/CN2022/091117
Other languages
English (en)
French (fr)
Inventor
严学强
赵明宇
吴建军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22814959.7A priority Critical patent/EP4328774A1/en
Priority to BR112023024508A priority patent/BR112023024508A2/pt
Publication of WO2022252912A1 publication Critical patent/WO2022252912A1/zh
Priority to US18/525,908 priority patent/US20240097917A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the embodiments of the present application relate to the field of data processing, and in particular, to a user data management method and related equipment.
  • User data management is one of the core functions of a mobile communication network. Both the provision of user services and the normal operation of the network depend on user data management entities and related processes.
  • the user data management entity of the mobile network stores user and service subscription related data, key information, etc., and is the key to realize user authentication, authorization, and access control.
  • each user has a lot of information, such as subscription information, key information and business information, etc., and these user information are all stored together in a centralized single-point user data management device.
  • the user data management device is connected to other control panel network entities or application servers to provide data access services.
  • user information is managed by Unified Data Management (UDM).
  • UDM manages network user data in a single network element. It can be paired with a user data repository, which stores user data. Information, UDM resides in the control plane.
  • user information Since user information is managed by a centralized single-point user data management device, it has a single point of failure and is vulnerable to distributed denial of service attacks (Distributed Denial of Service-DDoS), so it has a high data security risk.
  • distributed Denial of Service-DDoS distributed Denial of Service-DDoS
  • Embodiments of the present application provide a user data management method and related equipment, which are used to improve the security of user data.
  • the first aspect of the embodiment of the present application provides a user data management method, which is applied to the user data management system to manage user data.
  • the system includes a data request device, a data storage device and a block chain platform.
  • the data request device needs When accessing the data storage device, the user data management system performs corresponding operations.
  • the method includes: the data requesting device sends a first request to the blockchain platform, and the first request indicates that the data requesting device needs to access the data storage device.
  • the first request includes: The signature information of the data requesting device and the type of access; the data requesting device receives the first permission information sent by the blockchain platform, and the first permission information indicates whether the data requesting device has the right to access the data storage device, and the permission is related to the signature of the data requesting device
  • the information is related to the type of access; if the first permission information indicates that the data requesting device has the right to access the data storage device, the data requesting device sends a second request to the data storage device, and the second request includes the address of the access. That is to say, the determination of whether the data requesting device has the right to access the data storage device is related to the signature information of the data requesting device and the access type.
  • the data requesting device accesses the data storage device, it needs to obtain the blockchain platform to confirm that the data requesting device has corresponding permissions. Since the blockchain platform has the characteristics of decentralization and non-tampering, Therefore, the blockchain platform with authentication and authorization functions has no risk of single point of failure, and relatively little data is lost when it is attacked by distributed denial of service, so user data has higher security.
  • the first request includes the type of access, which further refines the access information, so that the blockchain platform can more accurately determine the authority corresponding to the first request.
  • the type of access includes writing data and reading data, and if the type of access is writing data, the first request also includes an address for access; if the type of access is reading If the data is fetched, the first permission information includes the access address.
  • the method further includes: the data requesting device receives confirmation information sent by the data storage device, and the confirmation information indicates that the data storage The device has already executed the task corresponding to the second request.
  • the data requesting device can know whether the data storage device has executed the task corresponding to the second request, so that a corresponding response can be made accordingly, which increases the information acquisition of the data requesting device.
  • the method further includes: the data requesting device receives a third request sent by the user equipment, and the third request indicates that the data The requesting device sends a first request to the blockchain platform.
  • the signature information of the data requesting device includes signature information of the user equipment.
  • the foregoing access types include data writing, data deletion, data reading, and data modification.
  • the method further includes: the data requesting device sends task result information to the user equipment, and the task result information indicates that the data Whether the storage requesting device has completed the task corresponding to the third request.
  • the user equipment can know whether the data storage device has executed the task corresponding to the second request, so that a corresponding response can be made accordingly, which increases the information acquisition of the user equipment.
  • the second aspect of the embodiment of the present application provides a user data management method.
  • the method is applied to a user data management system to manage user data.
  • the system includes a data request device, a data storage device and a block chain platform.
  • the data request device needs When accessing the data storage device, the user data management system performs corresponding operations.
  • the method includes: the data storage device receives the second request from the data requesting device, and the second request includes the address of the access; the data storage device sends the access request to the blockchain platform.
  • the access verification request instructs the data requesting device to send a second request to the data storage device; the data storage device receives the second permission information sent by the blockchain platform, and the second permission information indicates whether the data storage device can execute the second request corresponding to Task: if the second permission information indicates that the data storage device can execute the task corresponding to the second request, the data storage device executes the corresponding task according to the second request.
  • the blockchain platform has the characteristics of decentralization and non-tampering, Therefore, the blockchain platform with authentication and authorization functions has no risk of single point of failure, and relatively little data is lost when it is attacked by the network, so user data has higher security.
  • the first request includes the type of access, which further refines the access information, so that the blockchain platform can more accurately determine the authority corresponding to the first request; at the same time, since only the relevant information of user data is stored in In the blockchain platform, user data is stored in the data storage device, thereby avoiding the "blockchain expansion problem", “privacy problem” and the “right to forget problem” caused by the data cannot be tampered with.
  • the method further includes: the data storage device sends a response message to the blockchain platform, and the response message indicates that the data storage The device has already executed the task corresponding to the second request.
  • the method further includes: the data storage device sends confirmation information to the data requesting device, and the confirmation information indicates that the data storage device The task corresponding to the second request has been executed.
  • the third aspect of the embodiment of the present application provides a user data management method, which is applied to a user data management system to manage user data.
  • the system includes a data request device, a data storage device and a block chain platform.
  • the data request device needs When accessing the data storage device, the user data management system performs corresponding operations.
  • the method includes: the block chain platform receives the first request sent by the data requesting device, the first request indicates that the data requesting device needs to access the data storage device, and the first request Including the signature information of the data requesting device and the type of access; the blockchain platform determines whether the data requesting device can access the data storage device according to the signature information of the data requesting device and the type of access; the blockchain platform sends the first permission to the data requesting device information, the first permission information indicates whether the data requesting device can access the data storage device; the blockchain platform receives the access verification request sent by the data storage device, and the access verification request instructs the data requesting device to send a second request to the data storage device; if the block If the chain platform determines that the data requesting device can access the data storage device, the blockchain platform sends the second permission information to the data storage device, and the second permission information indicates that the data storage device can perform the task corresponding to the second request.
  • the data requesting device Before the data requesting device accesses the data storage device, it needs to obtain the blockchain platform to confirm that the data requesting device has the corresponding authority. Since the blockchain platform has the characteristics of decentralization and non-tampering, it has authentication and authorization functions. The blockchain platform has no risk of single point of failure, and relatively little data is lost when it is attacked by the network, so user data has higher security.
  • the first request includes the type of access, which further refines the access information, so that the blockchain platform can more accurately determine the authority corresponding to the first request.
  • the method further includes: the blockchain platform receives the response information sent by the data storage device, and the response information Indicate that the data storage device has performed the task corresponding to the second request; the blockchain platform records the data storage device has performed the task corresponding to the second request in the distributed ledger according to the response message.
  • the first permission information includes the address of the access.
  • a fourth aspect of the present application provides a data requesting device, where the data requesting device has a function of implementing the method in the first aspect or any possible implementation manner of the first aspect.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions, for example: a first sending module.
  • a fifth aspect of the present application provides a data storage device, and the data storage device has a function of implementing the method of the second aspect or any possible implementation manner of the second aspect.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions, for example: a first receiving module.
  • the sixth aspect of the present application provides a block chain platform device, the block chain platform device has the function of realizing the method of the above third aspect or any possible implementation manner of the third aspect.
  • This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware.
  • the hardware or software includes one or more modules corresponding to the above functions, for example: a first receiving module.
  • a seventh aspect of the present application provides a data requesting device, the data requesting device includes at least one processor, a memory, an input/output (input/output, I/O) interface, and a device stored in the memory and operable on the processor
  • the computer executes the instruction.
  • the processor executes the method according to the above first aspect or any possible implementation manner of the first aspect.
  • the eighth aspect of the present application provides a data storage device, the data storage device includes at least one processor, a memory, an input/output (input/output, I/O) interface, and a program stored in the memory and operable on the processor
  • the computer executes the instruction.
  • the processor executes the method according to the second aspect or any possible implementation manner of the second aspect.
  • the ninth aspect of the present application provides a block chain platform device
  • the data storage device includes at least one processor, memory, input/output (input/output, I/O) interface and stored in the memory and can be stored on the processor
  • the running computer executes the instructions, and when the computer executes the instructions are executed by the processor, the processor executes the method according to the above third aspect or any possible implementation manner of the third aspect.
  • the tenth aspect of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes any one of the above-mentioned first aspect or the first aspect. method of implementation.
  • the eleventh aspect of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes any one of the above-mentioned second aspect or second aspect. method of implementation.
  • the twelfth aspect of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes any of the possibilities of the third aspect or the third aspect. method of implementation.
  • the thirteenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes any possible implementation of the above-mentioned first aspect or the first aspect. way of way.
  • the fourteenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes any possible implementation of the above-mentioned second aspect or the second aspect. way of way.
  • the fifteenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes any possible implementation of the above-mentioned third aspect or the third aspect. way of way.
  • a sixteenth aspect of the present application provides a chip system, where the chip system includes at least one processor, and the at least one processor is configured to implement the functions involved in the above-mentioned first aspect or any possible implementation manner of the first aspect.
  • the system-on-a-chip may also include a memory, which is used to store necessary program instructions and data for the device processing the artificial intelligence model.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • a seventeenth aspect of the present application provides a chip system, where the chip system includes at least one processor, and the at least one processor is configured to implement the functions involved in the second aspect or any possible implementation manner of the second aspect.
  • the system-on-a-chip may further include a memory, which is used to store necessary program instructions and data of the device for data processing based on the artificial intelligence model.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the eighteenth aspect of the present application provides a system-on-a-chip, where the system-on-a-chip includes at least one processor, and the at least one processor is configured to implement the functions involved in the above-mentioned third aspect or any possible implementation manner of the third aspect.
  • the system-on-a-chip may further include a memory, which is used to store necessary program instructions and data of the device for data processing based on the artificial intelligence model.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices.
  • the data requesting device when the data requesting device needs to operate on the data, it needs to obtain the first permission information sent by the blockchain platform, thereby avoiding the risk of single point failure and being attacked by the network, and having high data security ;
  • the first request sent by the data requesting device since the first request sent by the data requesting device includes the signature information of the data requesting device, it is ensured that this operation is authorized by the user, and the user can know whether the mobile communication network provider is using the user's information, effectively protecting the information security of users.
  • FIG. 1 is a schematic diagram of a network architecture of a user data architecture of a 2G/3G/4G/IMS network;
  • FIG. 2 is a schematic diagram of a network architecture of a user data architecture of a 5G network
  • FIG. 3 is a schematic diagram of a scenario of a user data management method in an embodiment of the present application.
  • FIG. 4 is a schematic flow diagram of a method for managing user data in an embodiment of the present application.
  • FIG. 5 is another schematic flow diagram of the user data management method in the embodiment of the present application.
  • FIG. 6 is another schematic flowchart of the user data management method in the embodiment of the present application.
  • FIG. 7 is another schematic flowchart of the user data management method in the embodiment of the present application.
  • FIG. 8 is another schematic flowchart of the user data management method in the embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a data requesting device in an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a data storage device in an embodiment of the present application.
  • Fig. 11 is a schematic structural diagram of the blockchain platform device in the embodiment of the present application.
  • FIG. 12 is another schematic structural diagram of the data requesting device in the embodiment of the present application.
  • FIG. 13 is another schematic structural diagram of a data storage device in an embodiment of the present application.
  • Fig. 14 is another schematic structural diagram of the block chain platform device in the embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of the user data management system in the embodiment of the present application.
  • Embodiments of the present application provide a user data management method and related equipment, which are used to improve user information security.
  • User data management is one of the core functions of a mobile communication network. Both the provision of user services and the normal operation of the network depend on user data management entities and related processes.
  • the user data management entity of the mobile network stores user and service subscription related data, key information, etc., and is the key to realize user authentication, authorization, and access control.
  • each user has a lot of information, such as subscription information, key information and business information, etc., and these user information are all stored together in a centralized single-point user data management device.
  • the user data management device is connected to other control panel network entities or application servers to provide services such as data access and access.
  • the subscriber data management entities in 2G, 3G, 4G and Internet Protocol Multimedia System (IP Multimedia Subsystem, IMS) architectures are Home Location Register (Home Location Register, HLR) and Home Subscriber Server ( Home Subscriber Server, HSS), these entities interface with other control plane network functional entities or application servers to provide access and access services.
  • IMS Internet Protocol Multimedia Subsystem
  • UDM Unified Data Management
  • the data repository stores user information
  • UDM is on the control plane.
  • the embodiment of this application provides a user data management method.
  • the user data management system in this application includes a data request device, a blockchain platform, and a data storage device.
  • the device that performs the corresponding operation can be a data subject (Data Subject, DS), a data control device (Data Controller, DC), a data processing device (Data Processor, DP) and other devices, or it can be a user device or an access network device and core network elements
  • the user equipment can be notebook computers, tablet computers, computers, LTE assistance terminals, NR assistance terminals, assistants, semi-active tags, active tags, wireless relay stations, LTE mobile phones and NR mobile phones and other terminal equipment
  • the access network equipment may be a macro base station, a pole base station, a long term evolution (long term evolution, LTE) base station, an evolved (evolved NodeB, eNB) base station, a wireless relay (Relay) station, a Femto base station, a Pico base station, and a downlink Access network equipment such
  • the blockchain platform is used to store data operations, policy management transactions, and data pointers, which point to user data stored in data storage devices; specifically, the blockchain platform realizes decentralization and access authentication on the one hand. , authentication and authorization, and access control logic. On the other hand, all data operations and policy management records are recorded on an immutable distributed ledger.
  • the access records include storage addresses and access policies for personal user data.
  • the centralized trust model is eliminated, that is, the blockchain platform assumes the role of the authentication and authorization server. All operations of the data requesting device are authenticated and authorized by the blockchain platform; and the smart contract deployed on the blockchain undertakes automated access control management; and the blockchain undertakes a non-tamperable log system to record any Access to off-chain data.
  • the data storage device is used to store the user's personal data, and the user's personal data is not stored on the blockchain platform, thereby solving the "blockchain expansion problem", “privacy problem” and data immutable belt of the blockchain platform.
  • the user equipment can initiate an access request for user data
  • the operator network function device namely, the data control device DC or data processing device DP
  • the data control device DC or data processing device DP can also initiate an access request for user data, which are described below:
  • the user equipment initiates an operation request for user data.
  • a flow of the user data management method in the embodiment of the present application includes:
  • the user equipment sends a third request to the data requesting device.
  • the user equipment When the user equipment needs the data storage device to perform a corresponding task, the user equipment sends a third request to the data requesting device, and the third request instructs the data requesting device to send the first request to the block chain platform, and the third request includes the user Signature information of the device.
  • Step a The user equipment, that is, the data subject, sends an account opening request to the mobile service operator's Customer Relation Management (CRM) device or Business Operation Support System (BOSS), and the account opening request indicates that the user needs to create A new user account, the account opening request includes the user information corresponding to the user.
  • CRM Customer Relation Management
  • BOSS Business Operation Support System
  • Step b The CRM device receives the account opening request sent by the user device, and then verifies the user information according to the user information in the account opening request. If the user information of the user passes the user information verification, it means that the preset user conditions are met. For example, the If the user's user information is true and valid or the user's user information complies with relevant laws and regulations, etc., the CRM device will create a customer record for the user, and at the same time, the CRM device will send synchronization information to BOSS, so that BOSS will synchronize with the CRM device based on the synchronization information The above user information.
  • Step c BOSS receives the synchronization information sent by CRM, and synchronizes the above user information with the CRM device according to the synchronization information; then BOSS creates a customer profile record and sends synchronization success information to CRM, so that the CRM forwards the synchronization success information to For the user equipment, the synchronization success information indicates that the user profile is successfully generated and the CRM equipment and BOSS are successfully synchronized.
  • Step d The CRM device receives the synchronization success information sent by the BOSS and forwards it to the user equipment.
  • the synchronization success information sent to the user equipment can trigger the user equipment to initiate a transaction request, that is, the third request.
  • Step e The user equipment receives the synchronization success information sent by the CRM equipment, and then the user equipment initiates a transaction request to the CRM equipment and BOSS, and the transaction instructs the BOSS to initiate a transaction registry Treg, that is, the first request to the blockchain platform.
  • the user equipment sends the account cancellation request to the data requesting device such as the CRM device and the BOSS, and the account cancellation request is for the third request.
  • the user device sends a data read request to a data requesting device such as a CRM device and BOSS, and the data
  • the read request is the third request.
  • the data requesting device sends a first request to the blockchain platform.
  • the data requesting device sends a first request to the blockchain platform, the first request indicates that the data requesting device needs to access the data storage device, the first request includes the signature information of the data requesting device and the type of access, the signature information of the data requesting device It is used for the blockchain platform to determine the authority corresponding to the first request.
  • the type of the access may be data writing as shown in FIG. 5, data deletion as shown in FIG. 6, and data reading as shown in FIG. 7.
  • the embodiment of the present application The type of access in can also be other types, such as data modification, which is not limited here.
  • the first request includes the signature information of the data requesting device and the type of access.
  • the first request may include information about the user device or the tasks that the user device needs the data storage device to perform. Relevant information, for example, when the type of access is data writing, the first request further includes an access address, and the access address may be a data pointer, which is not specifically limited here.
  • the signature information of the data requesting device may include the signature information of the data requesting device, may also include the signature information of the user device, may also include the electronic signature information of the data requesting device and the signature information of the user device, or It can be other information that can indicate the data requesting device or user equipment, which is not limited here; in this embodiment of the application, the signature information can be an electronic signature, or identification information such as ID, which is not limited here.
  • the data requesting device is a device other than user equipment, such as a core network element or an access network device.
  • the data requesting device may also be a user device such as a terminal. If the If the data requesting device is a user device, step 401 is not performed, and the user device directly sends the first request to the blockchain platform, which is not limited here.
  • the following steps can be performed: after the data requesting device such as BOSS receives the transaction initiated by the user device, the BOSS sends the transaction to the blockchain platform Initiate a transaction registry Treg request, that is, the first request.
  • the transaction Treg request that is, the first request, includes user information, data pointers, access policies, that is, the type of access, and the user's digital signature.
  • the digital signature is used by the blockchain platform to determine whether it is The request initiated by the user is to determine the authenticity of the first request, and determine whether the first request is known and confirmed by the user, so as to determine the authority corresponding to the first request.
  • the data requesting device such as the CRM device and BOSS cancel the user relationship and subscription relationship with the user, and submit the
  • the blockchain platform sends a Tdereg request, which includes the user's signature information and access type; the Tdereg request is the first request.
  • data control equipment and data processing equipment such as CRM equipment and BOSS send Tdata to the blockchain platform
  • the data read request is the first request.
  • the blockchain platform sends the first permission information to the data requesting device.
  • the blockchain platform determines that the data requesting device can access the data storage device according to the signature information, the blockchain platform sends the first permission information to the data requesting device, and the first permission information indicates whether the data requesting device can access the data storage device.
  • the first permission information when the access type is reading data, the first permission information further includes an access address, and the access address may be a data pointer.
  • the blockchain platform determines the authority of the first request according to the signature information of the data requesting device included in the first request and the type of access.
  • the signature information has unique authenticity, that is, the digital signature can uniquely determine the data requesting device, and the digital signature is used by the blockchain platform to determine whether the request is initiated by the user device, that is, to determine the authenticity of the first request.
  • the blockchain platform After the blockchain determines that the data requesting device can access the data storage device, that is, the first request has corresponding permissions, the blockchain platform sends the first permission information to the data requesting device, and the first permission information indicates that the data request The device can access the data storage device, that is, the first request has the authority corresponding to the corresponding task.
  • the blockchain platform checks the relevant information included in the transaction Treg request, including whether the registration is initiated by the user device Account opening transaction, the access policy corresponding to the request, that is, the type of access, and whether the signature is a valid digital signature of the user device, etc. After the blockchain platform determines that the user has relevant permissions, for example, the user device has the ability to read and write all personal If the authority of user data and policy data is determined, the first permission information is sent to the data requesting device.
  • the blockchain platform checks the relevant information included in the transaction Tdereg request, including whether it is initiated by the user device Account cancellation transaction, the type of access corresponding to the request, and whether the signature is a valid digital signature of the user, etc. After the blockchain platform determines that the user has relevant permissions, for example, the user has the ability to delete all personal user data and policy data permission, the first permission information is sent to the data requesting device.
  • the block chain platform checks the relevant information included in the transaction Tdata request, including whether it is provided by the user Initiated access transactions and whether the signature is a valid digital signature of the user, etc., when the blockchain platform determines that the user has relevant permissions, for example, the user has the permission to access all personal user data and policy data, it requests data
  • the device sends first permission information, where the first permission information includes an access address, where the address may be a data pointer.
  • the data requesting device sends a second request to the data storage device.
  • the data requesting device After the data requesting device receives the first permission information, if the first permission information indicates that the data requesting device has the authority to access the data storage device, the data requesting device knows that the blockchain platform has determined that the data requesting device can access the data storage device Afterwards, the data requesting device sends a second request to the data storage device, and the second request instructs the data storage device to perform a task corresponding to the second request.
  • the second request includes the user's signature information.
  • the data requesting device sends a second request to the data storage device, and the second request includes the user's signature information and Task information such as a data pointer and the user's signature information, the second request instructs the data storage device to write data for the user, and the data address is given by the data pointer.
  • the data requesting device sends a second request to the data storage device, and the second request includes the user's signature information and task information such as the data pointer and the user's signature information, the second request instructs the data storage device to delete the user data of the user, and the data address may be given by the data pointer.
  • the data requesting device sends a second request to the data storage device, and the second request includes the user's Task information such as signature information, data pointer, and user signature information
  • the second request instructs the data storage device to send the user data corresponding to the second request to the data requesting device, and the data address can be given by the above data pointer.
  • the data storage device sends an access verification request to the blockchain platform.
  • the data storage device After the data storage device receives the second request sent by the data requesting device, since the second request instructs the data storage device to perform the corresponding task, the data storage device needs to confirm whether the second request has the authority corresponding to the task, Then the data storage device sends an access verification request to the blockchain platform, and the access verification request indicates that the data requesting device has sent a second request to the data storage device, and the access verification request includes the relevant information of the second request, so that the block The chain platform confirms the permission information of the second request according to the relevant information of the second request.
  • the blockchain platform sends the second permission information to the data storage device.
  • the blockchain platform After the blockchain platform receives the access verification request sent by the data storage device, the blockchain platform confirms whether the second request has the corresponding authority according to the relevant information of the second request in the access verification request, that is, whether the data storage device can After accessing the data storage device, the blockchain platform sends second permission information to the data storage device, and the second permission information can indicate whether the data storage device can perform the task corresponding to the second request.
  • the data storage device receives the second permission information and executes a task corresponding to the second request.
  • the data storage device receives the second permission information sent by the blockchain platform, the second permission information indicates that the data storage device can perform the task corresponding to the second request, that is, the user corresponding to the signature information contained in the second request Whether the authority of the device enables the data storage device to execute the task corresponding to the second request. If the second permission information indicates that the data storage device can perform the task corresponding to the second request, the data storage device can perform the task corresponding to the second request after receiving the second permission information.
  • the data storage device receives the second permission information, and after confirming that the task corresponding to the second request can be performed, according to The data pointer in the second request writes the corresponding data whose address is given by the data pointer.
  • the data storage device receives the second permission information, and after confirming that the task corresponding to the second request can be performed, The user data of the user is deleted according to the data pointer in the second request, and the data address may be given by the data pointer.
  • the data storage device receives the second permission information, and after confirming that the task corresponding to the second request can be performed Afterwards, the user data corresponding to the second request is sent to the data requesting device according to the second request, and the data address may be given by the above data pointer.
  • the data storage device sends response information to the blockchain platform.
  • the data storage device After the data storage device completes the task corresponding to the second request, it sends a response message to the blockchain platform, and the response message indicates that the data storage device has completed the task corresponding to the second request.
  • the response information includes relevant information of the task, such as result information of the task, identification information of the user who initiates the task, execution strategy of the task, and relevant information of the data storage device executing the task.
  • the blockchain platform receives the response information and records it in the distributed ledger.
  • the blockchain platform receives the response information sent by the data storage device, and the response information indicates that the data storage device has completed the task corresponding to the second request.
  • the response information includes the relevant information of the task, such as the result information of the task, The identification information of the user who initiated the task, the execution policy of the task, and the relevant information of the data storage device that executes the task; then the blockchain platform can broadcast the relevant information of the task to each node of the blockchain platform, in all After the nodes reach a consensus, the blockchain platform records the relevant information of the task in the non-tamperable distributed ledger of the blockchain platform.
  • Each node of the blockchain platform records complete information about the task, and the storage of each node is independent and of the same status.
  • the block chain platform checks the response information sent by the received data storage device and records the transaction Treg in the distributed ledger middle.
  • the blockchain platform checks the response information sent by the received data storage device and records the transaction Tdereg in the distributed in the ledger.
  • the block chain platform checks the response information sent by the received data storage device and records the transaction Tdata in in a distributed ledger.
  • the data storage device sends confirmation information to the data requesting device.
  • the data storage device sends a confirmation message to the data requesting device, where the confirmation message indicates that the data storage device has completed the task corresponding to the second request.
  • the data storage device may perform step 408 first, and then step 410.
  • step 410 may be performed first, and then step 408 may be performed, or both steps may be performed at the same time, which is not limited here.
  • the data storage device sends task result information to the user equipment.
  • the data storage device sends task result information to the user equipment, where the task result information indicates whether the data storage requesting device has completed the task corresponding to the third request.
  • the user equipment initiates an access request for user data.
  • the operator's network function device that is, the data control device DC or data processing device DP, can also initiate an access request for user data, which will be described in detail below. :
  • the operator's network function device can initiate an operation request for user data.
  • a flow of the user data management method in the embodiment of the present application includes:
  • the data requesting device sends a first request to the blockchain platform.
  • the data requesting device sends a first request to the blockchain platform, the first request indicates that the data requesting device needs to access the data storage device, and the first request includes the signature information of the data requesting device, that is, the network function device, user information and access type , the user information is the user information corresponding to the user data that the network functional device wants to access, and the signature information of the data requesting device is used by the blockchain platform to determine the authority corresponding to the first request.
  • the type of access may be data writing, data deletion, and data reading.
  • the type of access in this embodiment of the application may also be other types, which are not specifically limited here.
  • the first request includes the signature information of the data requesting device and the type of access.
  • the first request may include information about the user device or the tasks that the user device needs the data storage device to perform. Relevant information, for example, when the type of access is data writing, the first request further includes an access address, and the access address may be a data pointer, which is not specifically limited here.
  • the signature information may be an electronic signature, or identification information such as an ID, which is not specifically limited here.
  • the blockchain platform sends first permission information to the data requesting device.
  • the blockchain platform determines that the data requesting device can access the data storage device according to the signature information, the blockchain platform sends the first permission information to the data requesting device, and the first permission information indicates whether the data requesting device can access the data storage device.
  • the first permission information when the access type is reading data, the first permission information further includes an access address, and the access address may be a data pointer.
  • the blockchain platform determines the authority of the first request according to the signature information of the data requesting device included in the first request and the type of access.
  • the signature information has unique authenticity, that is, the digital signature can uniquely determine the data requesting device, and the digital signature is used by the blockchain platform to determine whether the request is initiated by the user device, that is, to determine the authenticity of the first request.
  • the blockchain platform After the blockchain determines that the data requesting device can access the data storage device, that is, the first request has corresponding permissions, the blockchain platform sends the first permission information to the data requesting device, and the first permission information indicates that the data request The device can access the data storage device, that is, the first request has the authority corresponding to the corresponding task.
  • the data requesting device sends a second request to the data storage device.
  • the data requesting device After the data requesting device receives the first permission information, if the first permission information indicates that the data requesting device has the authority to access the data storage device, the data requesting device knows that the blockchain platform has determined that the data requesting device can access the data storage device Afterwards, the data requesting device sends a second request to the data storage device, and the second request instructs the data storage device to perform a task corresponding to the second request.
  • the second request includes signature information of the data requesting device.
  • the data storage device sends an access verification request to the blockchain platform.
  • the data storage device After the data storage device receives the second request sent by the data requesting device, since the second request instructs the data storage device to perform the corresponding task, the data storage device needs to confirm whether the second request has the authority corresponding to the task, Then the data storage device sends an access verification request to the blockchain platform, and the access verification request indicates that the data requesting device has sent a second request to the data storage device, and the access verification request includes the relevant information of the second request, so that the block The chain platform confirms the permission information of the second request according to the relevant information of the second request.
  • the blockchain platform sends the second permission information to the data storage device.
  • the blockchain platform After the blockchain platform receives the access verification request sent by the data storage device, the blockchain platform confirms whether the second request has the corresponding authority according to the relevant information of the second request in the access verification request, that is, whether the data storage device can After accessing the data storage device, the blockchain platform sends second permission information to the data storage device, and the second permission information can indicate whether the data storage device can perform the task corresponding to the second request.
  • the data storage device receives the second permission information and executes a task corresponding to the second request.
  • the data storage device receives the second permission information sent by the blockchain platform, the second permission information indicates that the data storage device can perform the task corresponding to the second request, that is, the user corresponding to the signature information contained in the second request Whether the authority of the device enables the data storage device to execute the task corresponding to the second request. If the second permission information indicates that the data storage device can perform the task corresponding to the second request, the data storage device can perform the task corresponding to the second request after receiving the second permission information.
  • the data storage device sends response information to the blockchain platform.
  • the data storage device After the data storage device completes the task corresponding to the second request, it sends a response message to the blockchain platform, which indicates that the data storage device has completed the task corresponding to the second request.
  • the response information includes relevant information of the task, such as result information of the task, identification information of the user who initiates the task, execution strategy of the task, and relevant information of the data storage device executing the task.
  • the blockchain platform receives the response information and records it in the distributed ledger.
  • the blockchain platform receives the response information sent by the data storage device, and the response information indicates that the data storage device has completed the task corresponding to the second request.
  • the response information includes the relevant information of the task, such as the result information of the task, The identification information of the data requesting device that initiates the task, the execution strategy of the task, and the relevant information of the data storage device that executes the task; then the blockchain platform can broadcast the relevant information of the task to each node of the blockchain platform, After all nodes reach a consensus, the blockchain platform records the relevant information of the task in the non-tamperable distributed ledger of the blockchain platform. Each node of the blockchain platform records complete information about the task, and the storage of each node is independent and of the same status.
  • the data storage device sends confirmation information to the data requesting device.
  • the blockchain platform sends a confirmation message to the data requesting device, and the confirmation message indicates that the data storage device has completed the task corresponding to the second request.
  • the data storage device may first execute step 807, and then execute step 809; it may also execute first step 809, and then execute step 807, or both steps may be executed at the same time, which is not limited here.
  • the data requesting device may be the data requesting device in the above-mentioned FIGS.
  • the requesting device 900 includes:
  • the first sending module 901 is configured to send a first request to the blockchain platform, the first request indicates that the data requesting device needs to access the data storage device, and the first request includes the signature information of the data requesting device and the type of access; the specific implementation method is, Please refer to the data requesting device sending the first request to the blockchain platform in step 402 in FIG. 4 and the data requesting device sending the first request to the blockchain platform in step 801 in FIG. 8 , which will not be repeated here.
  • the first receiving module 902 is configured to receive the first permission information sent by the blockchain platform, the first permission information indicates whether the data requesting device has the right to access the data storage device, and the right is related to the signature information of the data requesting device and the type of access ;
  • the block chain platform sending the first permission information to the data requesting device in step 403 in Fig. 4 and the block chain platform sending the first permission information to the data requesting device in step 802 in Fig. 8. Let me repeat.
  • the second sending module 903 is configured to send a second request to the data storage device if the first permission information indicates that the data requesting device has permission to access the data storage device, and the second request includes an access address.
  • the data requesting device sending the second request to the data storage device in step 404 in FIG. 4 and the data requesting device sending the second request to the data storage device in step 803 in FIG. 8 , which will not be repeated here.
  • the second receiving module 904 is configured to receive confirmation information sent by the data storage device, where the confirmation information indicates that the data storage device has executed the task corresponding to the second request.
  • the confirmation information indicates that the data storage device has executed the task corresponding to the second request.
  • the third receiving module 905 is configured to receive a third request sent by the user equipment, and the third request instructs the data requesting equipment to send the first request to the blockchain platform.
  • the third request sent by the user equipment to the data requesting equipment in step 401 in FIG. 4 , which will not be repeated here.
  • the data requesting device 900 may perform the operations performed by the data requesting device in the embodiments shown in any one of FIG. 4 to FIG. 8 , and details are not repeated here.
  • a data storage device 1000 provided in the embodiment of the present application may be the data storage device in the above-mentioned FIGS.
  • Storage device 1000 includes:
  • the first receiving module 1001 is used to receive the second request of the data requesting device, the second request includes the address of the access; for the specific implementation, please refer to the data requesting device sending the second request to the data storage device in step 404 in FIG. In Step 803 in Step 8, the data requesting device sends a second request to the data storage device, which will not be repeated here.
  • the first sending module 1002 is used to send an access verification request to the block chain platform, and the access verification request instructs the data requesting device to send a second request to the data storage device; for the specific implementation, please refer to the data storage device in step 405 in Figure 4.
  • the blockchain platform sends the access verification request and the data storage device sends the access verification request to the blockchain platform in step 804 in FIG. 8 , which will not be repeated here.
  • the second receiving module 1003 is used to receive the second license information sent by the blockchain platform, and the second license information indicates whether the data storage device can perform the task corresponding to the second request; for the specific implementation, please refer to step 406 in Figure 4
  • the blockchain platform sends the second permission information to the data storage device and the blockchain platform sends the second permission information to the data storage device in step 805 in FIG. 8 , which will not be repeated here.
  • the executing module 1004 is configured to execute the corresponding task according to the second request if the second permission information indicates that the data storage device can execute the task corresponding to the second request.
  • the task corresponding to the data storage device receiving the second permission information and executing the second request in step 407 in FIG. 4 please refer to the task corresponding to the data storage device receiving the second permission information and executing the second request in step 806 in FIG. 8. task, which will not be repeated here.
  • the second sending module 1005 is configured to send response information to the blockchain platform, and the response information indicates that the data storage device has executed the task corresponding to the second request.
  • the response information sent by the data storage device to the blockchain platform in step 408 in Figure 4 please refer to the response information sent by the data storage device to the blockchain platform in step 807 in Figure 8, which will not be repeated here.
  • the third sending module 1006 is configured to send confirmation information to the data requesting device, where the confirmation information indicates that the data storage device has executed the task corresponding to the second request.
  • the confirmation information indicates that the data storage device has executed the task corresponding to the second request.
  • the data storage device 1000 may perform the operations performed by the data storage device in the embodiments shown in any one of FIG. 4 to FIG. 8 , and details are not described here again.
  • a block chain platform device 1100 provided in the embodiment of the application can be the above-mentioned Figure 4 to Figure 8 Blockchain platform equipment
  • the blockchain platform equipment 1100 includes:
  • the first receiving module 1101 is configured to receive the first request sent by the data requesting device, the first request indicates that the data requesting device needs to access the data storage device, and the first request includes the signature information of the data requesting device and the type of access; the specific implementation method is, Please refer to the data requesting device sending the first request to the blockchain platform in step 402 in FIG. 4 and the data requesting device sending the first request to the blockchain platform in step 801 in FIG. 8 , which will not be repeated here.
  • the determining module 1102 is used to determine whether the data requesting device can access the data storage device according to the signature information of the data requesting device and the type of access; for the specific implementation, please refer to the step 403 in FIG.
  • the first permission information and the first permission information sent by the blockchain platform to the data requesting device in step 802 in FIG. 8 will not be repeated here.
  • the first sending module 1103 is used to send the first permission information to the data requesting device, and the first permission information indicates whether the data requesting device can access the data storage device; for the specific implementation, please refer to the block chain platform in step 403 in Figure 4.
  • the data requesting device sends the first permission information and the block chain platform sends the first permission information to the data requesting device in step 802 in FIG. 8 , which will not be repeated here.
  • the second receiving module 1104 is configured to receive the access verification request sent by the data storage device, and the access verification request instructs the data requesting device to send a second request to the data storage device; for the specific implementation, please refer to the data storage device sending to the data storage device in step 405 in FIG. 4
  • the blockchain platform sends the access verification request and the data storage device sends the access verification request to the blockchain platform in step 804 in FIG. 8 , which will not be repeated here.
  • the second sending module 1105 is configured to send the second permission information to the data storage device if the block chain platform device determines that the data requesting device can access the data storage device, and the second permission information indicates that the data storage device can execute the data storage device corresponding to the second request. Task.
  • the block chain platform sending the second license information to the data storage device in step 406 in Figure 4 and the block chain platform sending the second license information to the data storage device in step 805 in Figure 8, which will not be repeated here. repeat.
  • the third receiving module 1106 is configured to receive the response information sent by the data storage device, and the response information indicates that the data storage device has executed the task corresponding to the second request; for the specific implementation, please refer to the block sent by the data storage device in step 408 in FIG. 4
  • the chain platform sends the response information and the data storage device sends the response information to the blockchain platform in step 807 in FIG. 8 , which will not be repeated here.
  • the recording module 1107 is configured to record the task corresponding to the second request performed by the data storage device into the distributed ledger according to the response message.
  • the block chain platform receiving the response information in step 409 in Figure 4 and recording it in the distributed ledger and the block chain platform receiving the response information in step 808 in Figure 8 and recording it in the distributed ledger, here No longer.
  • the block chain platform device 1100 can execute the operations performed by the block chain platform device in any one of the embodiments shown in FIG. 4 to FIG. 8 , and details will not be repeated here.
  • Fig. 12 is a schematic structural diagram of a data requesting device provided by an embodiment of the present application.
  • the data requesting device 1200 may include one or more processors 1201 and a memory 1205, and one or more application programs or data are stored in the memory 1205. .
  • the memory 1205 can also be integrated with the processor 1201 .
  • the memory is located outside the chip and connected to the processor 1201 through circuits or interfaces.
  • Processor 1201 may be a central processing unit (central processing unit, CPU) (similarly, processors in other devices below may also be CPUs, and details will not be repeated).
  • CPU central processing unit
  • the storage 1205 may be a volatile storage or a persistent storage.
  • the program stored in the memory 1205 may include one or more modules, and each module may include a series of instructions to operate on the data requesting device.
  • the processor 1201 may be configured to communicate with the memory 1205 , and execute a series of instruction operations in the memory 1205 on the data requesting device 1200 .
  • the processor 1201 is used to execute the computer program in the memory 1205, so that the data request device 1200 is used to perform: the data request device sends a first request to the block chain platform, and the first request indicates that the data request device needs to access the data storage device , the first request includes the signature information of the data requesting device and the type of access; the data requesting device receives the first permission information sent by the blockchain platform, and the first permission information indicates whether the data requesting device has the right to access the data storage device.
  • the signature information of the data requesting device is related to the type of access; if the first permission information indicates that the data requesting device has the right to access the data storage device, the data requesting device sends a second request to the data storage device, and the second request includes the address of the access.
  • the data requesting device sends a second request to the data storage device, and the second request includes the address of the access.
  • the data requesting device 1200 may also include one or more power sources 1202, one or more wired or wireless network interfaces 1203, one or more input and output interfaces 1204, and/or, one or more operating systems, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • one or more operating systems such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • the data requesting device 1200 may perform operations performed by the data requesting device in any one of the embodiments shown in FIGS.
  • FIG. 13 is a schematic structural diagram of a data storage device provided by an embodiment of the present application.
  • the data storage device 1300 may include one or more processors 1301 and a memory 1305, and one or more application programs or data are stored in the memory 1305. .
  • the storage 1305 may be a volatile storage or a persistent storage.
  • the program stored in the memory 1305 may include one or more modules, and each module may include a series of instructions to operate on the data storage device.
  • the processor 1301 may be configured to communicate with the memory 1305 , and execute a series of instruction operations in the memory 1305 on the data storage device 1300 .
  • the processor 1301 is used to execute the computer program in the memory 1305, so that the data storage device 1300 is used to execute: the data storage device receives the second request from the data requesting device, and the second request includes the address to be accessed;
  • the block chain platform sends an access verification request, and the access verification request instructs the data requesting device to send a second request to the data storage device;
  • the data storage device receives the second permission information sent by the block chain platform, and the second permission information indicates whether the data storage device can execute A task corresponding to the second request; if the second permission information indicates that the data storage device can perform the task corresponding to the second request, the data storage device performs the corresponding task according to the second request.
  • steps 401-411 in the embodiment shown in FIG. 4 and steps 801-809 in the embodiment shown in FIG. 8 which will not be repeated here.
  • the data storage device 1300 may also include one or more power sources 1302, one or more wired or wireless network interfaces 1303, one or more input and output interfaces 1304, and/or, one or more operating systems, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • one or more operating systems such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • the data storage device 1300 may perform the operations performed by the data storage device in any one of the embodiments shown in FIGS. 4-8 , which will not be detailed here.
  • FIG 14 is a schematic structural diagram of a block chain platform device provided by an embodiment of the present application.
  • the block chain platform device 1400 may include one or more processors 1401 and a memory 1405, and the memory 1405 stores one or more application or data.
  • the storage 1405 may be a volatile storage or a persistent storage.
  • the program stored in the memory 1405 may include one or more modules, and each module may include a series of instruction operations on the blockchain platform device.
  • the processor 1401 can be configured to communicate with the memory 1405, and execute a series of instruction operations in the memory 1405 on the blockchain platform device 1400.
  • the processor 1401 is used to execute the computer program in the memory 1405, so that the blockchain platform device 1400 is used to execute: the blockchain platform receives the first request sent by the data requesting device, and the first request indicates that the data requesting device needs to access
  • the first request includes the signature information of the data requesting device and the type of access
  • the blockchain platform determines whether the data requesting device can access the data storage device according to the signature information of the data requesting device and the type of access
  • the blockchain platform sends The data requesting device sends the first permission information, and the first permission information indicates whether the data requesting device can access the data storage device
  • the blockchain platform receives the access verification request sent by the data storage device, and the access verification request instructs the data requesting device to send to the data storage device
  • the second request if the blockchain platform determines that the data requesting device can access the data storage device, the blockchain platform sends the second permission information to the data storage device, and the second permission information indicates that the data storage device can perform the task corresponding to the second request .
  • the block chain platform device 1400 can also include one or more power supplies 1402, one or more wired or wireless network interfaces 1403, one or more input and output interfaces 1404, and/or, one or more operating systems, such as Windows ServerTM , Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • one or more operating systems such as Windows ServerTM , Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • the block chain platform device 1400 can perform the operations performed by the block chain platform device in any one of the embodiments shown in FIGS. 4-8 , and details will not be repeated here.
  • Fig. 15 is a schematic structural diagram of a user data management system 1500 provided by an embodiment of the present application.
  • the user data management system 1500 may include a data request device 1501, a data storage device 1502, and a blockchain platform device 1503.
  • the data request device 1501 The operation performed by the data requesting device in any one of the embodiments shown in FIGS. 4-8 can be performed; the data storage device 1502 can perform the operations performed by the data storage device in any one of the embodiments shown in FIGS. 4-8 operation; the block chain platform device 1503 can perform the operations performed by the block chain platform device in any one of the embodiments shown in FIGS. 4-8.
  • the disclosed system, device and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • a unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disc, etc., which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请实施例公开了一种用户数据管理方法以及相关设备，用于提升用户的信息安全。本申请实施例方法包括：数据请求设备向区块链平台发送第一请求，第一请求指示数据请求设备需要访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；数据请求设备接收区块链平台发送的第一许可信息，第一许可信息指示数据请求设备是否拥有访问数据存储设备的权限，对数据请求设备是否拥有对数据存储设备的访问权限的判断与数据请求设备的签名信息以及访问的类型有关；若第一许可信息指示数据请求设备拥有访问数据存储设备的权限，则数据请求设备向数据存储设备发送第二请求，第二请求包括访问的地址。

Description

一种用户数据管理方法以及相关设备
本申请要求于2021年06月04日提交中国专利局、申请号为202110626638.6、发明名称为“一种用户数据管理方法以及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及数据处理领域，尤其涉及一种用户数据管理方法以及相关设备。
背景技术
用户数据管理是移动通信网络最核心功能之一。用户业务的提供和网络的正常运营都需要依赖于用户数据管理实体和相关流程。移动网络的用户数据管理实体，存储用户和业务订阅相关数据，密钥信息等，是实现用户鉴权认证、授权以及访问控制的关键。
在目前的2G到5G核心网架构中，每一个用户都有着许多信息，例如签约信息、密钥信息和业务信息等等，这些用户信息都是在一个集中式的单点用户数据管理设备中一起进行管理，该用户数据管理设备与其他控制面板网络实体或应用服务器连接，从而提供数据的访问服务。例如在5G网络的核心网架构中，用户信息由统一数据管理(Unified Data Management，UDM)，UDM在单个网元中管理网络用户数据，它可以与用户数据存储库配对，用户数据存储库存储用户信息，UDM位于控制平面。
由于用户的信息都由集中式的单点用户数据管理设备进行管理，所以有单点失效和易受到分布式拒绝服务攻击(Distributed Denial of Service-DDoS)，因此具有较高的数据安全风险。
发明内容
本申请实施例提供了一种用户数据管理方法以及相关设备，用于提升用户数据的安全性。
本申请实施例第一方面提供了一种用户数据管理方法，该方法应用于用户数据管理系统管理用户的数据，该系统包括数据请求设备、数据存储设备和区块链平台，当数据请求设备需要访问数据存储设备时，用户数据管理系统执行对应的操作，具体该方法包括：数据请求设备向区块链平台发送第一请求，第一请求指示数据请求设备需要访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；数据请求设备接收区块链平台发送的第一许可信息，第一许可信息指示数据请求设备是否拥有访问数据存储设备的权限，权限与数据请求设备的签名信息和访问的类型有关；若第一许可信息指示数据请求设备拥有访问数据存储设备的权限，则数据请求设备向数据存储设备发送第二请求，第二请求包括访问的地址。也就是说，对所述数据请求设备是否拥有访问所述数据存储设备的权限的判断与所述数据请求设备的签名信息和所述访问的类型有关。
该种可能的实现方式中，数据请求设备在访问数据存储设备之前，需要获得区块链平台确认该数据请求设备具有相应的权限，由于区块链平台具有去中心化和不可篡改性等特性，因此具有鉴权和授权功能的区块链平台的没有单点失效的风险，受到分布式拒绝服务攻击时 损失的数据相对也很少，因此用户数据具有更高的安全性。另一方面，该第一请求中包括访问的类型，进一步细化了访问信息，从而使得区块链平台可以更精准地确定第一请求对应的权限。
在第一方面的一种可能的实现方式中，访问的类型包括写入数据和读取数据，若访问的类型为写入数据，则第一请求还包括访问的地址；若访问的类型为读取数据，则第一许可信息包括访问的地址。
在第一方面的一种可能的实现方式中，在上述数据请求设备向数据存储设备发送第二请求之后，该方法还包括：数据请求设备接收数据存储设备发送的确认信息，确认信息指示数据存储设备已经执行第二请求对应的任务。
该种可能的实现方式中，使得数据请求设备可以得知数据存储设备是否已经执行第二请求对应的任务，从而可以据此作出相应的响应，增加了数据请求设备的信息获取。
在第一方面的一种可能的实现方式中，在上述数据请求设备向区块链平台发送第一请求，该方法还包括：数据请求设备接收用户设备发送的第三请求，第三请求指示数据请求设备向区块链平台发送第一请求。
在第一方面的一种可能的实现方式中，上述数据请求设备的签名信息包括用户设备的签名信息。
在第一方面的一种可能的实现方式中，上述访问的类型包括数据写入、数据删除、数据读取和数据修改。
在第一方面的一种可能的实现方式中，在上述数据请求设备接收数据存储设备发送的确认信息之后，该方法还包括：数据请求设备向用户设备发送任务结果信息，该任务结果信息指示数据存请求设备是否已经完成了第三请求对应的任务。
该种可能的实现方式中，使得用户设备可以得知数据存储设备是否已经执行第二请求对应的任务，从而可以据此作出相应的响应，增加了用户设备的信息获取。
本申请实施例第二方面提供了一种用户数据管理方法，该方法应用于用户数据管理系统管理用户的数据，该系统包括数据请求设备、数据存储设备和区块链平台，当数据请求设备需要访问数据存储设备时，用户数据管理系统执行对应的操作，具体该方法包括：数据存储设备接收数据请求设备的第二请求，第二请求包括访问的地址；数据存储设备向区块链平台发送访问验证请求，访问验证请求指示数据请求设备向数据存储设备发送第二请求；数据存储设备接收区块链平台发送的第二许可信息，第二许可信息指示数据存储设备是否可以执行第二请求对应的任务；若第二许可信息指示数据存储设备可以执行第二请求对应的任务，则数据存储设备根据第二请求执行对应的任务。
该种可能的实现方式中，数据请求设备在访问数据存储设备之前，需要获得区块链平台确认该数据请求设备具有相应的权限，由于区块链平台具有去中心化和不可篡改性等特性，因此具有鉴权和授权功能的区块链平台的没有单点失效的风险，被网络攻击时损失的数据相对也很少，因此用户数据具有更高的安全性。另一方面，该第一请求中包括访问的类型，进一步细化了访问信息，从而使得区块链平台可以更精准地确定第一请求对应的权限；同时，由于只有用户数据的相关信息存储在区块链平台中，用户数据都存储在数据存储设备中，从而避免了“区块链膨胀问题”、“隐私问题”和数据不可篡改带来的“遗忘权问题”。
在第二方面的一种可能的实现方式中，在上述数据存储设备根据第二请求执行对应的任务之后，该方法还包括：数据存储设备向区块链平台发送响应信息，响应信息指示数据存储设备已经执行第二请求对应的任务。
在第二方面的一种可能的实现方式中，在上述数据存储设备根据第二请求执行对应的任务之后，该方法还包括：数据存储设备向数据请求设备发送确认信息，确认信息指示数据存储设备已经执行第二请求对应的任务。
本申请实施例第三方面提供了一种用户数据管理方法，该方法应用于用户数据管理系统管理用户的数据，该系统包括数据请求设备、数据存储设备和区块链平台，当数据请求设备需要访问数据存储设备时，用户数据管理系统执行对应的操作，具体该方法包括：区块链平台接收数据请求设备发送的第一请求，第一请求指示数据请求设备需要访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；区块链平台根据数据请求设备的签名信息和访问的类型确定数据请求设备是否可以访问数据存储设备；区块链平台向数据请求设备发送第一许可信息，第一许可信息指示数据请求设备是否可以访问数据存储设备；区块链平台接收数据存储设备发送的访问验证请求，访问验证请求指示数据请求设备向数据存储设备发送第二请求；若区块链平台确定数据请求设备可以访问数据存储设备，则区块链平台向数据存储设备发送第二许可信息，第二许可信息指示数据存储设备可以执行第二请求对应的任务。
数据请求设备在访问数据存储设备之前，需要获得区块链平台确认该数据请求设备具有相应的权限，由于区块链平台具有去中心化和不可篡改性等特性，因此具有鉴权和授权功能的区块链平台的没有单点失效的风险，被网络攻击时损失的数据相对也很少，因此用户数据具有更高的安全性。另一方面，该第一请求中包括访问的类型，进一步细化了访问信息，从而使得区块链平台可以更精准地确定第一请求对应的权限。
在第三方面的一种可能的实现方式中，在上述区块链平台向数据存储设备发送第二许可信息之后，该方法还包括：区块链平台接收数据存储设备发送的响应信息，响应信息指示数据存储设备已经执行第二请求对应的任务；区块链平台根据响应消息将数据存储设备已经执行第二请求对应的任务记入分布式账本。
该种可能的实现方式中，由于对用户数据的访问等交易都记录分布式账本上，因此用户数据并不完全由移动通信网络提供商管理，用户对于自己的个人数据有完全的知情权和控制权，用户可以知道移动通信网络提供商是否合规使用和有效保护用户的信息。
在第三方面的一种可能的实现方式中，若访问的类型为读取数据，则第一许可信息包括访问的地址。
本申请第四方面提供一种数据请求设备，该数据请求设备具有实现上述第一方面或第一方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块，例如：第一发送模块。
本申请第五方面提供一种数据存储设备，该数据存储设备具有实现上述第二方面或第二方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块，例如：第一接收 模块。
本申请第六方面提供一种区块链平台设备，该区块链平台设备具有实现上述第三方面或第三方面任意一种可能实现方式的方法的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块，例如：第一接收模块。
本申请第七方面提供一种数据请求设备，该数据请求设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当计算机执行指令被处理器执行时，处理器执行如上述第一方面或第一方面任意一种可能的实现方式的方法。
本申请第八方面提供一种数据存储设备，该数据存储设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当计算机执行指令被处理器执行时，处理器执行如上述第二方面或第二方面任意一种可能的实现方式的方法。
本申请第九方面提供一种区块链平台设备，该数据存储设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当计算机执行指令被处理器执行时，处理器执行如上述第三方面或第三方面任意一种可能的实现方式的方法。
本申请第十方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，处理器执行如上述第一方面或第一方面任意一种可能的实现方式的方法。
本申请第十一方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，处理器执行如上述第二方面或第二方面任意一种可能的实现方式的方法。
本申请第十二方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，处理器执行如上述第三方面或第三方面任意一种可能的实现方式的方法。
本申请第十三方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当计算机执行指令被处理器执行时，处理器执行如上述第一方面或第一方面任意一种可能的实现方式的方法。
本申请第十四方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当计算机执行指令被处理器执行时，处理器执行如上述第二方面或第二方面任意一种可能的实现方式的方法。
本申请第十五方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当计算机执行指令被处理器执行时，处理器执行如上述第三方面或第三方面任意一种可能的实现方式的方法。
本申请第十六方面提供了一种芯片系统，该芯片系统包括至少一个处理器，至少一个处理器用于实现上述第一方面或第一方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于保存处理人工智能模型的装置必要的 程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
本申请第十七方面提供了一种芯片系统，该芯片系统包括至少一个处理器，至少一个处理器用于实现上述第二方面或第二方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于保存基于人工智能模型的数据处理的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
本申请第十八方面提供了一种芯片系统，该芯片系统包括至少一个处理器，至少一个处理器用于实现上述第三方面或第三方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器用于保存基于人工智能模型的数据处理的装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
从以上技术方案可以看出，本申请实施例具有以下优点：
本申请实施例中，数据请求设备在需要对数据进行操作时，需要得到区块链平台发送的第一许可信息，从而避免了单点失效和被网络攻击的风险，具有较高的数据安全性；另一方面，由于数据请求设备发送的第一请求包括数据请求设备的签名信息，从而确保了本次操作得到了用户的授权，保证了用户可以得知移动通信网络提供商是否合规使用用户信息，有效保护用户的信息安全。
附图说明
图1为2G/3G/4G/IMS网络的用户数据架构的一个网络架构示意图；
图2为5G网络的用户数据架构的一个网络架构示意图；
图3为本申请实施例中用户数据管理方法的一个场景示意图；
图4为本申请实施例中用户数据管理方法的一个流程示意图；
图5为本申请实施例中用户数据管理方法的另一个流程示意图；
图6为本申请实施例中用户数据管理方法的另一个流程示意图；
图7为本申请实施例中用户数据管理方法的另一个流程示意图；
图8为本申请实施例中用户数据管理方法的另一个流程示意图；
图9为本申请实施例中数据请求设备的一个结构示意图；
图10为本申请实施例中数据存储设备的一个结构示意图；
图11为本申请实施例中区块链平台设备的一个结构示意图；
图12为本申请实施例中数据请求设备的另一个结构示意图；
图13为本申请实施例中数据存储设备的另一个结构示意图；
图14为本申请实施例中区块链平台设备的另一个结构示意图；
图15为本申请实施例中用户数据管理系统的一个结构示意图。
具体实施方式
本申请实施例提供了一种用户数据管理方法以及相关设备，用于提升用户的信息安全。
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
用户数据管理是移动通信网络最核心功能之一。用户业务的提供和网络的正常运营都需要依赖于用户数据管理实体和相关流程。移动网络的用户数据管理实体，存储用户和业务订阅相关数据，密钥信息等，是实现用户鉴权认证、授权以及访问控制的关键。
在目前的2G到5G核心网架构中，每一个用户都有着许多信息，例如签约信息、密钥信息和业务信息等等，这些用户信息都是在一个集中式的单点用户数据管理设备中一起进行处理，该用户数据管理设备与其他控制面板网络实体或应用服务器连接，从而提供数据的访问和存取等服务。如图1所示，例如在2G、3G、4G以及网际互连协议多媒体系统(IP Multimedia Subsystem，IMS)架构中的用户数据管理实体是归属位置寄存器(Home Location Register，HLR)和归属用户服务器(Home Subscriber Server，HSS)，这些实体与其他控制面网络功能实体或应用服务器接口，提供访问和存取服务。如图2所示，例如在5G网络的核心网架构中，用户信息由统一数据管理(Unified Data Management，UDM)，UDM在单个元素中管理网络用户数据，它可以与用户数据存储库配对，用户数据存储库存储用户信息，UDM位于控制平面。
基于上述移动通信网络，下面对本申请实施例中的用户数据管理方法进行描述：
如图3所示，本申请实施例提供了一种用户数据管理方法，本申请中的用户数据管理系统包括数据请求设备、区块链平台和数据存储设备，数据请求设备为需要对用户的数据进行相应的操作的设备，可以是数据主体(Data Subject，DS)、数据控制设备(Data Controller，DC)和数据处理设备(Data Processor，DP)等设备，也可以是用户设备、接入网设备和核心网网元，该用户设备可以是笔记本电脑、平板电脑、计算机、LTE协助终端、NR协助终端、协助器、半有源标签、有源标签、无线中继站、LTE手机和NR手机等终端设备；该接入网设备可以是宏基站、杆基站、长期演进(long term evolution，LTE)基站、演进型(evolved NodeB，eNB)基站、无线中继(Relay)站、Femto基站、Pico基站和下一代(next generation NodeB，gNB)基站等接入网设备；该核心网网元可以是身份验证服务器、会话管理服务器等核心网网元。本申请的实施例既可以用于现有的5G系统，也可以适用于未来各种通信系统和场景，例如车联网，海量用户接入，卫星通信，蜂窝通信等等。
区块链平台用来存储数据操作、策略管理交易以及数据指针，该数据指针指向数据存储设备的存储的用户数据；具体地，区块链平台一方面实现了去中心化，实现了访问的认证、鉴权和授权以及访问控制逻辑，另一方面将所有数据操作和策略管理记录都记录在不可篡改的分布式账本上，该访问记录包括个人用户数据的存储地址和访问策略。本申请实施例中， 通过区块链平台的去中心化、不可篡改性、可追溯性和透明性等特性，消除集中式信任模式，即区块链平台承担鉴权和授权服务器的角色，针对数据请求设备的所有操作由区块链平台进行鉴权和授权；并且由部署在区块链的智能合约承担自动化的访问控制管理；并且由区块链承担不可篡改日志系统，用于记录任何对链下数据的访问操作。
数据存储设备用来存储用户的个人数据，用户的个人数据并不存储在区块链平台上，从而解决的区块链平台的“区块链膨胀问题”、“隐私问题”和数据不可篡改带来的“数据遗忘权问题”。
本申请实施例中，用户设备可以发起对于用户数据的访问请求，运营商网络功能设备即数据控制设备DC或数据处理设备DP也可以发起对于用户数据的访问请求，下面分别进行说明：
一、用户设备发起对于用户数据的操作请求。
如图4所示，本申请实施例中用户数据管理方法的一个流程包括：
401、用户设备向数据请求设备发送第三请求。
当用户设备需要数据存储设备执行对应的任务时，用户设备就向数据请求设备发送第三请求，该第三请求指示该数据请求设备向区块链平台发送第一请求，第三请求中包括用户设备的签名信息。
具体地，如图5所示，一种可能的实现方式中，当用户需要开户时，可执行如下步骤：
步骤a：用户设备即数据主体向移动业务运营商的客户关系管理(Customer Relation Management，CRM)设备或业务运营支撑系统(Business Operation Support System，BOSS)发送开户请求，该开户请求指示该用户需要创建一个新的用户账户，该开户请求包括该用户对应的用户信息。
步骤b：CRM设备接收用户设备发送的开户请求，然后根据开户请求中的用户信息进行用户资料校验，若该用户的用户信息通过用户资料校验，即满足了预设的用户条件，例如该用户的用户信息真实有效或该用户的用户信息符合相关法律规定等，则CRM设备为该用户创建一个客户记录，同时该CRM设备向BOSS发送同步信息，以使得BOSS根据该同步信息与CRM设备同步上述用户信息。
步骤c：BOSS接收CRM发送的同步信息，并根据该同步信息与CRM设备同步上述用户信息；然后BOSS创建一条客户资料记录并向CRM发送同步成功信息，以使得该CRM将该同步成功信息转发给用户设备，该同步成功信息指示用户资料生成成功且CRM设备与BOSS同步成功。
步骤d：CRM设备接收BOSS发送的同步成功信息并转发给用户设备，该发送给用户设备的同步成功信息可以触发用户设备发起一个交易请求即第三请求。
步骤e：用户设备接收CRM设备发送的同步成功信息，然后用户设备向CRM设备和BOSS发起一个交易请求，该交易指示BOSS向区块链平台发起交易注册表Treg即第一请求。
具体地，如图6所示，一种可能的实现方式中，当用户需要销户时，可执行如下步骤：用户设备向数据请求设备例如CRM设备和BOSS发送销户请求，该销户请求即为第三请求。
具体地，如图7所示，一种可能的实现方式中，当用户需要访问个人用户数据时，可执行如下步骤：用户设备向数据请求设备例如CRM设备和BOSS发送数据读取请求，该数据读取请求即为第三请求。
402、数据请求设备向区块链平台发送第一请求。
数据请求设备向区块链平台发送第一请求，该第一请求指示数据请求设备需要访问数据存储设备，该第一请求包括数据请求设备的签名信息和访问的类型，该数据请求设备的签名信息用于区块链平台确定第一请求对应的权限。
本申请实施例中，该访问的类型可以是如图5所示的数据写入、如图6所示的数据删除和如图7所示的数据读取，除此之外，本申请实施例中的访问的类型也可以是其他类型，例如数据修改，具体此处不做限定。
本申请实施例中，该第一请求包括数据请求设备的签名信息和访问的类型，除此之外，本申请实施例中该可以包括用户设备信息、或者用户设备需要数据存储设备执行的任务的相关信息，例如当访问的类型为数据写入时，该第一请求还包括访问的地址，该访问的地址可以是一个数据指针，具体此处不做限定。
本申请实施例中，该数据请求设备的签名信息可以包括该数据请求设备的签名信息，也可以包括用户设备的签名信息，也可以包括数据请求设备的电子签名信息和用户设备的签名信息，也可以是其他可以指示数据请求设备或用户设备的信息，具体此处不做限定；本申请实施例中，该签名信息可以是电子签名，也可以是ID等标识信息，具体此处不做限定。
本申请实施例中，该数据请求设备为用户设备之外的设备，例如核心网网元或接入网设备，除此之外，该数据请求设备也可以是终端之类的用户设备，若该数据请求设备为用户设备，则不执行步骤401，用户设备直接向区块链平台发送第一请求，具体此处不做限定。
具体地，如图5所示，一种可能的实现方式中，当用户需要开户时，可执行如下步骤：数据请求设备例如BOSS在接收到该用户设备发起的交易之后，BOSS向区块链平台发起交易注册表Treg请求即第一请求，该交易Treg请求即第一请求包括用户信息、数据指针、访问策略即访问的类型和用户的数字签名，该数字签名用于区块链平台确定是不是该用户发起的请求，即确定第一请求的真实性，确定该第一请求是不是该用户知晓并经过该用户确认的，从而可以确定第一请求对应的权限。
具体地，如图6所示，一种可能的实现方式中，当用户需要销户时，可执行如下步骤：数据请求设备例如CRM设备和BOSS解除与该用户的用户关系和订购关系，并且向区块链平台发送Tdereg请求，该Tdereg请求包括用户的签名信息和访问的类型；该Tdereg请求即为第一请求。
具体地，如图7所示，一种可能的实现方式中，当用户需要访问个人用户数据时，可执行如下步骤：数据控制设备和数据处理设备例如CRM设备和BOSS向区块链平台发送Tdata数据读取请求即第一请求。
403、区块链平台向数据请求设备发送第一许可信息。
若区块链平台根据签名信息确定数据请求设备可以访问数据存储设备，则区块链平台向数据请求设备发送第一许可信息，该第一许可信息指示数据请求设备是否可以访问数据存储设备。
一种可能的实现方式中，当访问的类型为读取数据时，该第一许可信息还包括访问的地址，该访问的地址可以是一个数据指针。
具体地，该区块链平台在接收到数据请求设备发送的第一请求之后，根据该第一请求中 包括的数据请求设备的签名信息和访问的类型确定该第一请求的权限，由于该数字签名信息具有唯一的真实可靠性，即该数字签名可以唯一的确定该数据请求设备，该数字签名用于区块链平台确定是不是该用户设备发起的请求，即确定第一请求的真实性，确定该第一请求是不是该用户设备知晓并经过该用户设备确认的，从而可以确定第一请求对应的权限，即确定发送该第一请求的数据请求设备有没有权限去访问该数据存储设备并使得数据存储设备执行相应的任务。当该区块链确定该数据请求设备可以访问数据存储设备之后，即该第一请求具有相应的权限，区块链平台向数据请求设备发送第一许可信息，该第一许可信息指示该数据请求设备可以访问数据存储设备，即该第一请求具有其对应的任务相应的权限。
具体地，如图5所示，一种可能的实现方式中，当用户需要开户时，可执行如下步骤：区块链平台检查交易Treg请求包括的相关信息，包括是否是由用户设备发起的注册开户交易、该请求对应的访问策略即访问的类型和该签名是否为该用户设备有效的数字签名等，当该区块链平台确定该用户具有相关的权限之后例如该用户设备具有读写所有个人用户数据和策略数据的权限，就向数据请求设备发送第一许可信息。
具体地，如图6所示，一种可能的实现方式中，当用户需要销户时，可执行如下步骤：区块链平台检查交易Tdereg请求包括的相关信息，包括是否是由用户设备发起的销户交易、该请求对应的访问的类型和该签名是否为该用户有效的数字签名等，当该区块链平台确定该用户具有相关的权限之后例如该用户具有删除所有个人用户数据和策略数据的权限，就向数据请求设备发送第一许可信息。
具体地，如图7所示，一种可能的实现方式中，当用户需要读取个人用户数据时，可执行如下步骤：区块链平台检查交易Tdata请求包括的相关信息，包括是否是由用户发起的访问交易和该签名是否为该用户有效的数字签名等，当该区块链平台确定该用户具有相关的权限之后例如该用户具有访问所有个人用户数据和策略数据的权限，就向数据请求设备发送第一许可信息，该第一许可信息中包括访问的地址，该地址可以是一个数据指针。
404、数据请求设备向数据存储设备发送第二请求。
数据请求设备在收到第一许可信息之后，若该第一许可信息指示数据请求设备拥有访问数据存储设备的权限则数据请求设备得知区块链平台已经确定该数据请求设备可以访问数据存储设备之后，该数据请求设备向数据存储设备发送第二请求，该第二请求指示数据存储设备执行第二请求对应的任务。该第二请求中包括用户的签名信息。
具体地，如图5所示，一种可能的实现方式中，当用户需要开户时，可执行如下步骤：数据请求设备向数据存储设备发送第二请求，该第二请求包括用户的签名信息和数据指针和用户的签名信息等任务信息，该第二请求指示数据存储设备为该用户写入数据，数据地址由上述数据指针给出。
具体地，如图6所示，一种可能的实现方式中，当用户需要销户时，可执行如下步骤：数据请求设备向数据存储设备发送第二请求，该第二请求包括用户的签名信息和数据指针和用户的签名信息等任务信息，该第二请求指示数据存储设备删除该用户的用户数据，数据地址可以由上述数据指针给出。
具体地，如图7所示，一种可能的实现方式中，当用户需要访问个人用户数据时，可执行如下步骤：数据请求设备向数据存储设备发送第二请求，该第二请求包括用户的签名信息 和数据指针和用户的签名信息等任务信息，该第二请求指示数据存储设备向数据请求设备发送第二请求相对应的用户数据，数据地址可以由上述数据指针给出。
数据存储设备向区块链平台发送访问验证请求。
数据存储设备在接收到数据请求设备发送的第二请求之后，由于该第二请求指示数据存储设备执行对应的任务，该数据存储设备就需要确认该第二请求是否有与该任务对应的权限，则该数据存储设备向区块链平台发送访问验证请求，该访问验证请求指示数据请求设备向数据存储设备发送了第二请求，该访问验证请求包括该第二请求的相关信息，以使得区块链平台根据该第二请求的相关信息确认该第二请求的权限信息。
406、区块链平台向数据存储设备发送第二许可信息。
区块链平台在接收数据存储设备发送的访问验证请求之后，区块链平台根据该访问验证请求中第二请求的相关信息确认该第二请求是否具有相应的权限，即该数据存储设备是否可以访问该数据存储设备，然后该区块链平台向数据存储设备发送第二许可信息，该第二许可信息可以指示该数据存储设备是否可以执行第二请求对应的任务。
407、数据存储设备接收第二许可信息并执行第二请求对应的任务。
数据存储设备接收区块链平台发送的第二许可信息，该第二许可信息指示该数据存储设备是都可以执行第二请求对应的任务，即该第二请求中包含的签名信息所对应的用户设备具有的权限是否可以使该数据存储设备执行第二请求对应的任务。若该第二许可信息指示该数据存储设备可以执行第二请求对应的任务，数据存储设备在接收到第二许可信息之后就可以执行第二请求对应的任务。
具体地，如图5所示，一种可能的实现方式中，当用户需要开户时，可执行如下步骤：数据存储设备接收第二许可信息，在确认可以执行第二请求对应的任务后，根据第二请求中的数据指针写入相应的数据，该数据的地址由数据指针给出。
具体地，如图6所示，一种可能的实现方式中，当用户需要销户时，可执行如下步骤：数据存储设备接收第二许可信息，在确认可以执行第二请求对应的任务后，根据第二请求中的数据指针删除该用户的用户数据，数据地址可以由上述数据指针给出。
具体地，如图7所示，一种可能的实现方式中，当用户需要访问个人用户数据时，可执行如下步骤：数据存储设备接收第二许可信息，在确认可以执行第二请求对应的任务后，根据第二请求向数据请求设备发送第二请求相对应的用户数据，数据地址可以由上述数据指针给出。
408、数据存储设备向区块链平台发送响应信息。
数据存储设备在执行完第二请求对应的任务之后，就向区块链平台发送响应信息，该响应信息指示数据存储设备已经完成了第二请求对应的任务。该响应信息中包括该任务的相关信息，例如任务的结果信息、发起该任务的用户的标识信息、任务的执行策略和执行该任务的数据存储设备的相关信息。
409、区块链平台接收响应信息并记录在分布式账本中。
区块链平台接收数据存储设备发送的响应信息，该响应信息指示数据存储设备已经完成了第二请求对应的任务，相应地，该响应信息中包括该任务的相关信息，例如任务的结果信息、发起该任务的用户的标识信息、任务的执行策略和执行该任务的数据存储设备的相关信 息；然后区块链平台可以将该任务的相关信息广播给区块链平台的每个节点，在所有节点达成共识后，区块链平台将该任务的相关信息记录在区块链平台的不可篡改的分布式账本中。该区块链平台的每个节点都记录了完整的该任务的相关信息，且每个节点的存储都是独立的地位相同的。
具体地，如图5所示，一种可能的实现方式中，当用户需要开户时，可执行如下步骤：区块链平台检查接收数据存储设备发送的响应信息并将交易Treg记录在分布式账本中。
具体地，如图6所示，一种可能的实现方式中，当用户需要销户时，可执行如下步骤：区块链平台检查接收数据存储设备发送的响应信息并将交易Tdereg记录在分布式账本中。
具体地，如图7所示，一种可能的实现方式中，当用户需要访问个人用户数据时，可执行如下步骤：区块链平台检查接收数据存储设备发送的响应信息并将交易Tdata记录在分布式账本中。
410、数据存储设备向数据请求设备发送确认信息。
数据存储设备向数据请求设备发送确认消息，该确认消息指示数据存储设备已经完成了第二请求对应的任务。
本申请实施例中，数据存储设备可以先执行步骤408，再执行步骤410.也可以先执行步骤410，再执行步骤408，也可以两个两个步骤同时执行，具体此处不做限定。
411、数据存储设备向用户设备发送任务结果信息。
数据存储设备向用户设备发送任务结果信息，该任务结果信息指示数据存请求设备是否已经完成了第三请求对应的任务。
本申请实施例中，用户设备发起对于用户数据的访问请求，除此之外，运营商网络功能设备即数据控制设备DC或数据处理设备DP也可以发起对于用户数据的访问请求，下面具体进行说明：
二、运营商网络功能设备可以通过发起对于用户数据的操作请求。
如图8所示，本申请实施例中用户数据管理方法的一个流程包括：
801、数据请求设备向区块链平台发送第一请求。
数据请求设备向区块链平台发送第一请求，该第一请求指示数据请求设备需要访问数据存储设备，该第一请求包括数据请求设备即网络功能设备的签名信息、用户的信息和访问的类型，该用户的信息为网络功能设备想要访问的用户数据对应的用户的信息，该数据请求设备的签名信息用于区块链平台确定第一请求对应的权限。
本申请实施例中，该访问的类型可以是数据写入、数据删除和数据读取，除此之外，本申请实施例中的访问的类型也可以是其他类型，具体此处不做限定。
本申请实施例中，该第一请求包括数据请求设备的签名信息和访问的类型，除此之外，本申请实施例中该可以包括用户设备信息、或者用户设备需要数据存储设备执行的任务的相关信息，例如当访问的类型为数据写入时，该第一请求还包括访问的地址，该访问的地址可以是一个数据指针，具体此处不做限定。
本申请实施例中，该签名信息可以是电子签名，也可以是ID等标识信息，具体此处不做限定。
802、区块链平台向数据请求设备发送第一许可信息。
若区块链平台根据签名信息确定数据请求设备可以访问数据存储设备，则区块链平台向数据请求设备发送第一许可信息，该第一许可信息指示数据请求设备是否可以访问数据存储设备。
一种可能的实现方式中，当访问的类型为读取数据时，该第一许可信息还包括访问的地址，该访问的地址可以是一个数据指针。
具体地，该区块链平台在接收到数据请求设备发送的第一请求之后，根据该第一请求中包括的数据请求设备的签名信息和访问的类型确定该第一请求的权限，由于该数字签名信息具有唯一的真实可靠性，即该数字签名可以唯一的确定该数据请求设备，该数字签名用于区块链平台确定是不是该用户设备发起的请求，即确定第一请求的真实性，确定该第一请求是不是该用户设备知晓并经过该用户设备确认的，从而可以确定第一请求对应的权限，即确定发送该第一请求的数据请求设备有没有权限去访问该数据存储设备并使得数据存储设备执行相应的任务。当该区块链确定该数据请求设备可以访问数据存储设备之后，即该第一请求具有相应的权限，区块链平台向数据请求设备发送第一许可信息，该第一许可信息指示该数据请求设备可以访问数据存储设备，即该第一请求具有其对应的任务相应的权限。
803、数据请求设备向数据存储设备发送第二请求。
数据请求设备在收到第一许可信息之后，若该第一许可信息指示数据请求设备拥有访问数据存储设备的权限则数据请求设备得知区块链平台已经确定该数据请求设备可以访问数据存储设备之后，该数据请求设备向数据存储设备发送第二请求，该第二请求指示数据存储设备执行第二请求对应的任务。该第二请求中包括数据请求设备的签名信息。
804、数据存储设备向区块链平台发送访问验证请求。
数据存储设备在接收到数据请求设备发送的第二请求之后，由于该第二请求指示数据存储设备执行对应的任务，该数据存储设备就需要确认该第二请求是否有与该任务对应的权限，则该数据存储设备向区块链平台发送访问验证请求，该访问验证请求指示数据请求设备向数据存储设备发送了第二请求，该访问验证请求包括该第二请求的相关信息，以使得区块链平台根据该第二请求的相关信息确认该第二请求的权限信息。
805、区块链平台向数据存储设备发送第二许可信息。
区块链平台在接收数据存储设备发送的访问验证请求之后，区块链平台根据该访问验证请求中第二请求的相关信息确认该第二请求是否具有相应的权限，即该数据存储设备是否可以访问该数据存储设备，然后该区块链平台向数据存储设备发送第二许可信息，该第二许可信息可以指示该数据存储设备是否可以执行第二请求对应的任务。
806、数据存储设备接收第二许可信息并执行第二请求对应的任务。
数据存储设备接收区块链平台发送的第二许可信息，该第二许可信息指示该数据存储设备是都可以执行第二请求对应的任务，即该第二请求中包含的签名信息所对应的用户设备具有的权限是否可以使该数据存储设备执行第二请求对应的任务。若该第二许可信息指示该数据存储设备可以执行第二请求对应的任务，数据存储设备在接收到第二许可信息之后就可以执行第二请求对应的任务。
807、数据存储设备向区块链平台发送响应信息。
数据存储设备在执行完第二请求对应的任务之后，就向区块链平台发送响应信息，该响 应信息指示数据存储设备已经完成了第二请求对应的任务。该响应信息中包括该任务的相关信息，例如任务的结果信息、发起该任务的用户的标识信息、任务的执行策略和执行该任务的数据存储设备的相关信息。
808、区块链平台接收响应信息并记录在分布式账本中。
区块链平台接收数据存储设备发送的响应信息，该响应信息指示数据存储设备已经完成了第二请求对应的任务，相应地，该响应信息中包括该任务的相关信息，例如任务的结果信息、发起该任务的数据请求设备的标识信息、任务的执行策略和执行该任务的数据存储设备的相关信息；然后区块链平台可以将该任务的相关信息广播给区块链平台的每个节点，在所有节点达成共识后，区块链平台将该任务的相关信息记录在区块链平台的不可篡改的分布式账本中。该区块链平台的每个节点都记录了完整的该任务的相关信息，且每个节点的存储都是独立的地位相同的。
809、数据存储设备向数据请求设备发送确认信息。
区块链平台向数据请求设备发送确认消息，该确认消息指示数据存储设备已经完成了第二请求对应的任务。
本申请实施例中，数据存储设备可以先执行步骤807，再执行步骤809；也可以先执行步骤809，再执行步骤807，也可以两个步骤同时执行，具体此处不做限定。
下面对本申请实施例中的数据请求设备进行描述，请参阅图9，本申请实施例提供的一种数据请求设备900，该数据请求设备可以为上述图4至图8中数据请求设备，该数据请求设备900包括：
第一发送模块901，用于向区块链平台发送第一请求，第一请求指示数据请求设备需要访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；具体实现方式，请参考图4中步骤402中数据请求设备向区块链平台发送第一请求和图8中步骤801中数据请求设备向区块链平台发送第一请求，此处不再赘述。
第一接收模块902，用于接收区块链平台发送的第一许可信息，第一许可信息指示数据请求设备是否拥有访问数据存储设备的权限，权限与数据请求设备的签名信息和访问的类型有关；具体实现方式，请参考图4中步骤403中区块链平台向数据请求设备发送第一许可信息和图8中步骤802中区块链平台向数据请求设备发送第一许可信息，此处不再赘述。
第二发送模块903，用于若第一许可信息指示数据请求设备拥有访问数据存储设备的权限，则向数据存储设备发送第二请求，第二请求包括访问的地址。具体实现方式，请参考图4中步骤404中数据请求设备向数据存储设备发送第二请求和图8中步骤803中数据请求设备向数据存储设备发送第二请求，此处不再赘述。
第二接收模块904，用于接收数据存储设备发送的确认信息，确认信息指示数据存储设备已经执行第二请求对应的任务。具体实现方式，请参考图4中步骤410中数据存储设备向数据请求设备发送确认信息和图8中步骤809中数据存储设备向数据请求设备发送确认信息，此处不再赘述。
第三接收模块905，用于接收用户设备发送的第三请求，第三请求指示数据请求设备向区块链平台发送第一请求。具体实现方式，请参考图4中步骤401中用户设备向数据请求设备发送第三请求，此处不再赘述。
本实施例中，数据请求设备900可以执行前述图4至图8中任一项所示实施例中数据请求设备所执行的操作，具体此处不再赘述。
下面对本申请实施例中的数据存储设备进行描述，请参阅图10，本申请实施例提供的一种数据存储设备1000，该数据存储设备可以为上述图4至图8中数据存储设备，该数据存储设备1000包括：
第一接收模块1001，用于接收数据请求设备的第二请求，第二请求包括访问的地址；具体实现方式，请参考图4中步骤404中数据请求设备向数据存储设备发送第二请求和图8中步骤803中数据请求设备向数据存储设备发送第二请求，此处不再赘述。
第一发送模块1002，用于向区块链平台发送访问验证请求，访问验证请求指示数据请求设备向数据存储设备发送第二请求；具体实现方式，请参考图4中步骤405中数据存储设备向区块链平台发送访问验证请求和图8中步骤804中数据存储设备向区块链平台发送访问验证请求，此处不再赘述。
第二接收模块1003，用于接收区块链平台发送的第二许可信息，第二许可信息指示数据存储设备是否可以执行第二请求对应的任务；具体实现方式，请参考图4中步骤406中区块链平台向数据存储设备发送第二许可信息和图8中步骤805中区块链平台向数据存储设备发送第二许可信息，此处不再赘述。
执行模块1004，用于若第二许可信息指示数据存储设备可以执行第二请求对应的任务，则根据第二请求执行对应的任务。具体实现方式，请参考图4中步骤407中数据存储设备接收第二许可信息并执行第二请求对应的任务和图8中步骤806中数据存储设备接收第二许可信息并执行第二请求对应的任务，此处不再赘述。
第二发送模块1005，用于向区块链平台发送响应信息，响应信息指示数据存储设备已经执行第二请求对应的任务。具体实现方式，请参考图4中步骤408中数据存储设备向区块链平台发送响应信息和图8中步骤807中数据存储设备向区块链平台发送响应信息，此处不再赘述。
第三发送模块1006，用于向数据请求设备发送确认信息，确认信息指示数据存储设备已经执行第二请求对应的任务。具体实现方式，请参考图4中步骤410中数据存储设备向数据请求设备发送确认信息和图8中步骤809中数据存储设备向数据请求设备发送确认信息，此处不再赘述。
本实施例中，数据存储设备1000可以执行前述图4至图8中任一项所示实施例中数据存储设备所执行的操作，具体此处不再赘述。
下面对本申请实施例中的区块链平台设备进行描述，请参阅图11，本申请实施例提供的一种区块链平台设备1100，该区块链平台设备可以为上述图4至图8中区块链平台设备，该区块链平台设备1100包括：
第一接收模块1101，用于接收数据请求设备发送的第一请求，第一请求指示数据请求设备需要访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；具体实现方式，请参考图4中步骤402中数据请求设备向区块链平台发送第一请求和图8中步骤801中数据请求设备向区块链平台发送第一请求，此处不再赘述。
确定模块1102，用于根据数据请求设备的签名信息和访问的类型确定数据请求设备是否 可以访问数据存储设备；具体实现方式，请参考图4中步骤403中区块链平台向数据请求设备发送第一许可信息和图8中步骤802中区块链平台向数据请求设备发送第一许可信息，此处不再赘述。
第一发送模块1103，用于向数据请求设备发送第一许可信息，第一许可信息指示数据请求设备是否可以访问数据存储设备；具体实现方式，请参考图4中步骤403中区块链平台向数据请求设备发送第一许可信息和图8中步骤802中区块链平台向数据请求设备发送第一许可信息，此处不再赘述。
第二接收模块1104，用于接收数据存储设备发送的访问验证请求，访问验证请求指示数据请求设备向数据存储设备发送第二请求；具体实现方式，请参考图4中步骤405中数据存储设备向区块链平台发送访问验证请求和图8中步骤804中数据存储设备向区块链平台发送访问验证请求，此处不再赘述。
第二发送模块1105，用于若区块链平台设备确定数据请求设备可以访问数据存储设备，则向数据存储设备发送第二许可信息，第二许可信息指示数据存储设备可以执行第二请求对应的任务。具体实现方式，请参考图4中步骤406中区块链平台向数据存储设备发送第二许可信息和图8中步骤805中区块链平台向数据存储设备发送第二许可信息，此处不再赘述。
第三接收模块1106，用于接收数据存储设备发送的响应信息，响应信息指示数据存储设备已经执行第二请求对应的任务；具体实现方式，请参考图4中步骤408中数据存储设备向区块链平台发送响应信息和图8中步骤807中数据存储设备向区块链平台发送响应信息，此处不再赘述。
记入模块1107，用于根据响应消息将数据存储设备已经执行第二请求对应的任务记入分布式账本。具体实现方式，请参考图4中步骤409中区块链平台接收响应信息并记录在分布式账本中和图8中步骤808中区块链平台接收响应信息并记录在分布式账本中，此处不再赘述。
本实施例中，区块链平台设备1100可以执行前述图4至图8中任一项所示实施例中区块链平台设备所执行的操作，具体此处不再赘述。
图12是本申请实施例提供的一种数据请求设备结构示意图，该数据请求设备1200可以包括一个或一个以上处理器1201和存储器1205，该存储器1205中存储有一个或一个以上的应用程序或数据。在有些实施方案中，存储器1205还可以和处理器1201集成在一起。在另一些实施方案中，存储器位于芯片外，通过电路或接口与处理器1201相连。处理器1201可以是中央处理器(central processing unit，CPU)(类似的，下面其他设备中的处理器也可以使CPU，不再赘述)。
其中，存储器1205可以是易失性存储或持久存储。存储在存储器1205的程序可以包括一个或一个以上模块，每个模块可以包括对数据请求设备中的一系列指令操作。更进一步地，处理器1201可以设置为与存储器1205通信，在数据请求设备1200上执行存储器1205中的一系列指令操作。
其中，处理器1201用于执行存储器1205中的计算机程序，以使得数据请求设备1200用于执行：数据请求设备向区块链平台发送第一请求，第一请求指示数据请求设备需要访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；数据请求设备接收区块 链平台发送的第一许可信息，第一许可信息指示数据请求设备是否拥有访问数据存储设备的权限，权限与数据请求设备的签名信息和访问的类型有关；若第一许可信息指示数据请求设备拥有访问数据存储设备的权限，则数据请求设备向数据存储设备发送第二请求，第二请求包括访问的地址。具体实现方式，请参考图4所示实施例中步骤401-411和图8所示实施例中步骤801-809，此处不再赘述。
数据请求设备1200还可以包括一个或一个以上电源1202，一个或一个以上有线或无线网络接口1203，一个或一个以上输入输出接口1204，和/或，一个或一个以上操作系统，例如Windows ServerTM，Mac OS XTM，UnixTM,LinuxTM，FreeBSDTM等。
该数据请求设备1200可以执行前述图4-8所示的任一个实施例中数据请求设备所执行的操作，具体此处不再赘述。
图13是本申请实施例提供的一种数据存储设备结构示意图，该数据存储设备1300可以包括一个或一个以上处理器1301和存储器1305，该存储器1305中存储有一个或一个以上的应用程序或数据。
其中，存储器1305可以是易失性存储或持久存储。存储在存储器1305的程序可以包括一个或一个以上模块，每个模块可以包括对数据存储设备中的一系列指令操作。更进一步地，处理器1301可以设置为与存储器1305通信，在数据存储设备1300上执行存储器1305中的一系列指令操作。
其中，处理器1301用于执行存储器1305中的计算机程序，以使得数据存储设备1300用于执行：数据存储设备接收数据请求设备的第二请求，第二请求包括访问的地址；数据存储设备向区块链平台发送访问验证请求，访问验证请求指示数据请求设备向数据存储设备发送第二请求；数据存储设备接收区块链平台发送的第二许可信息，第二许可信息指示数据存储设备是否可以执行第二请求对应的任务；若第二许可信息指示数据存储设备可以执行第二请求对应的任务，则数据存储设备根据第二请求执行对应的任务。具体实现方式，请参考图4所示实施例中步骤401-411和图8所示实施例中步骤801-809，此处不再赘述。
数据存储设备1300还可以包括一个或一个以上电源1302，一个或一个以上有线或无线网络接口1303，一个或一个以上输入输出接口1304，和/或，一个或一个以上操作系统，例如Windows ServerTM，Mac OS XTM，UnixTM,LinuxTM，FreeBSDTM等。
该数据存储设备1300可以执行前述图4-8所示的任一个所示实施例中数据存储设备所执行的操作，具体此处不再赘述。
图14是本申请实施例提供的一种区块链平台设备结构示意图，该区块链平台设备1400可以包括一个或一个以上处理器1401和存储器1405，该存储器1405中存储有一个或一个以上的应用程序或数据。
其中，存储器1405可以是易失性存储或持久存储。存储在存储器1405的程序可以包括一个或一个以上模块，每个模块可以包括对区块链平台设备中的一系列指令操作。更进一步地，处理器1401可以设置为与存储器1405通信，在区块链平台设备1400上执行存储器1405中的一系列指令操作。
其中，处理器1401用于执行存储器1405中的计算机程序，以使得区块链平台设备1400用于执行：区块链平台接收数据请求设备发送的第一请求，第一请求指示数据请求设备需要 访问数据存储设备，第一请求包括数据请求设备的签名信息和访问的类型；区块链平台根据数据请求设备的签名信息和访问的类型确定数据请求设备是否可以访问数据存储设备；区块链平台向数据请求设备发送第一许可信息，第一许可信息指示数据请求设备是否可以访问数据存储设备；区块链平台接收数据存储设备发送的访问验证请求，访问验证请求指示数据请求设备向数据存储设备发送第二请求；若区块链平台确定数据请求设备可以访问数据存储设备，则区块链平台向数据存储设备发送第二许可信息，第二许可信息指示数据存储设备可以执行第二请求对应的任务。具体实现方式，请参考图4所示实施例中步骤401-411和图8所示实施例中步骤801-809，此处不再赘述。
区块链平台设备1400还可以包括一个或一个以上电源1402，一个或一个以上有线或无线网络接口1403，一个或一个以上输入输出接口1404，和/或，一个或一个以上操作系统，例如Windows ServerTM，Mac OS XTM，UnixTM,LinuxTM，FreeBSDTM等。
该区块链平台设备1400可以执行前述图4-8所示的任一个实施例中区块链平台设备所执行的操作，具体此处不再赘述。
图15是本申请实施例提供的一种用户数据管理系统1500的结构示意图，该用户数据管理系统1500可以包括数据请求设备1501、数据存储设备1502和区块链平台设备1503，该数据请求设备1501可以执行前述图4-8所示的任一个实施例中数据请求设备所执行的操作；该数据存储设备1502可以执行前述图4-8所示的任一个所示实施例中数据存储设备所执行的操作；该区块链平台设备1503可以执行前述图4-8所示的任一个实施例中区块链平台设备所执行的操作。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而前述的 存储介质包括：U盘、移动硬盘、只读存储器(ROM，read-only memory)、随机存取存储器(RAM，random access memory)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (27)

  1. 一种用户数据管理方法，其特征在于，所述方法包括：
    数据请求设备向区块链平台发送第一请求，所述第一请求指示所述数据请求设备需要访问数据存储设备，所述第一请求包括数据请求设备的签名信息和访问的类型；
    所述数据请求设备接收所述区块链平台发送的第一许可信息，所述第一许可信息指示所述数据请求设备是否拥有访问所述数据存储设备的权限，所述权限与所述数据请求设备的签名信息和所述访问的类型有关；
    若所述第一许可信息指示所述数据请求设备拥有访问所述数据存储设备的权限，则所述数据请求设备向所述数据存储设备发送第二请求，所述第二请求包括访问的地址。
  2. 根据权利要求1所述的方法，其特征在于，所述访问的类型包括写入数据和读取数据；
    若所述访问的类型为写入数据，则所述第一请求还包括访问的地址；
    若所述访问的类型为读取数据，则所述第一许可信息包括所述访问的地址。
  3. 根据权利要求1或2所述的方法，其特征在于，在所述数据请求设备向数据存储设备发送第二请求之后，所述方法还包括：
    所述数据请求设备接收所述数据存储设备发送的确认信息，所述确认信息指示所述数据存储设备已经执行所述第二请求对应的任务。
  4. 根据权利要求3所述的方法，其特征在于，在所述数据请求设备向区块链平台发送第一请求，所述方法还包括：
    所述数据请求设备接收用户设备发送的第三请求，所述第三请求指示所述数据请求设备向区块链平台发送第一请求。
  5. 根据权利要求4所述的方法，其特征在于，所述数据请求设备的签名信息包括所述用户设备的签名信息。
  6. 一种用户数据管理方法，其特征在于，所述方法包括：
    数据存储设备接收数据请求设备的第二请求，所述第二请求包括访问的地址；
    所述数据存储设备向区块链平台发送访问验证请求，所述访问验证请求指示所述数据请求设备向所述数据存储设备发送第二请求；
    所述数据存储设备接收所述区块链平台发送的第二许可信息，所述第二许可信息指示所述数据存储设备是否可以执行所述第二请求对应的任务；
    若所述第二许可信息指示所述数据存储设备可以执行所述第二请求对应的任务，则所述数据存储设备根据所述第二请求执行对应的任务。
  7. 根据权利要求6所述的方法，其特征在于，在所述数据存储设备根据所述第二请求执行对应的任务之后，所述方法还包括：
    所述数据存储设备向所述区块链平台发送响应信息，所述响应信息指示所述数据存储设备已经执行所述第二请求对应的任务。
  8. 根据权利要求6或7所述的方法，其特征在于，在所述数据存储设备根据所述第二请求执行对应的任务之后，所述方法还包括：
    所述数据存储设备向所述数据请求设备发送确认信息，所述确认信息指示所述数据存储设备已经执行所述第二请求对应的任务。
  9. 一种用户数据管理方法，其特征在于，所述方法包括：
    区块链平台接收数据请求设备发送的第一请求，所述第一请求指示所述数据请求设备需要访问数据存储设备，所述第一请求包括数据请求设备的签名信息和访问的类型；
    所述区块链平台根据所述数据请求设备的签名信息和访问的类型确定所述数据请求设备是否可以访问所述数据存储设备；
    所述区块链平台向所述数据请求设备发送第一许可信息，所述第一许可信息指示所述数据请求设备是否可以访问所述数据存储设备；
    所述区块链平台接收所述数据存储设备发送的访问验证请求，所述访问验证请求指示所述数据请求设备向所述数据存储设备发送第二请求；
    若所述区块链平台确定所述数据请求设备可以访问所述数据存储设备，则所述区块链平台向所述数据存储设备发送第二许可信息，所述第二许可信息指示所述数据存储设备可以执行所述第二请求对应的任务。
  10. 根据权利要求9所述的方法，其特征在于，在所述区块链平台向所述数据存储设备发送第二许可信息之后，所述方法还包括：
    所述区块链平台接收所述数据存储设备发送的响应信息，所述响应信息指示所述数据存储设备已经执行所述第二请求对应的任务；
    所述区块链平台根据所述响应消息将所述数据存储设备已经执行所述第二请求对应的任务记入分布式账本。
  11. 根据权利要求9或10所述的方法，其特征在于，若所述访问的类型为读取数据，则所述第一许可信息包括所述访问的地址。
  12. 一种数据请求设备，其特征在于，所述数据请求设备包括：
    第一发送模块，用于向区块链平台发送第一请求，所述第一请求指示所述数据请求设备需要访问数据存储设备，所述第一请求包括数据请求设备的签名信息和访问的类型；
    第一接收模块，用于接收所述区块链平台发送的第一许可信息，所述第一许可信息指示所述数据请求设备是否拥有访问所述数据存储设备的权限，所述权限与所述数据请求设备的签名信息和所述访问的类型有关；
    第二发送模块，用于若所述第一许可信息指示所述数据请求设备拥有访问所述数据存储设备的权限，则向所述数据存储设备发送第二请求，所述第二请求包括访问的地址。
  13. 根据权利要求12所述的数据请求设备，其特征在于，所述访问的类型包括写入数据和读取数据；
    若所述访问的类型为写入数据，则所述第一请求还包括访问的地址；
    若所述访问的类型为读取数据，则所述第一许可信息包括所述访问的地址。
  14. 根据权利要求12或13所述的数据请求设备，其特征在于，所述数据请求设备还包括：
    第二接收模块，用于接收所述数据存储设备发送的确认信息，所述确认信息指示所述数据存储设备已经执行所述第二请求对应的任务。
  15. 根据权利要求14所述的数据请求设备，其特征在于，所述数据请求设备还包括：
    第三接收模块，用于接收用户设备发送的第三请求，所述第三请求指示所述数据请求设备向区块链平台发送第一请求。
  16. 一种数据存储设备，其特征在于，所述数据存储设备包括：
    第一接收模块，用于接收数据请求设备的第二请求，所述第二请求包括访问的地址；
    第一发送模块，用于向区块链平台发送访问验证请求，所述访问验证请求指示所述数据请求设备向所述数据存储设备发送第二请求；
    第二接收模块，用于接收所述区块链平台发送的第二许可信息，所述第二许可信息指示所述数据存储设备是否可以执行所述第二请求对应的任务；
    执行模块，用于若所述第二许可信息指示所述数据存储设备可以执行所述第二请求对应的任务，则根据所述第二请求执行对应的任务。
  17. 根据权利要求16所述的数据存储设备，其特征在于，所述数据存储设备还包括：
    第二发送模块，用于向所述区块链平台发送响应信息，所述响应信息指示所述数据存储设备已经执行所述第二请求对应的任务。
  18. 根据权利要求16或17所述的数据存储设备，其特征在于，所述数据存储设备还包括：
    第三发送模块，用于向所述数据请求设备发送确认信息，所述确认信息指示所述数据存储设备已经执行所述第二请求对应的任务。
  19. 一种区块链平台设备，其特征在于，所述区块链平台设备包括：
    第一接收模块，用于接收数据请求设备发送的第一请求，所述第一请求指示所述数据请求设备需要访问数据存储设备，所述第一请求包括数据请求设备的签名信息和访问的类型；
    确定模块，用于根据所述数据请求设备的签名信息和访问的类型确定所述数据请求设备是否可以访问所述数据存储设备；
    第一发送模块，用于向所述数据请求设备发送第一许可信息，所述第一许可信息指示所述数据请求设备是否可以访问所述数据存储设备；
    第二接收模块，用于接收所述数据存储设备发送的访问验证请求，所述访问验证请求指示所述数据请求设备向所述数据存储设备发送第二请求；
    第二发送模块，用于若所述区块链平台设备确定所述数据请求设备可以访问所述数据存储设备，则向所述数据存储设备发送第二许可信息，所述第二许可信息指示所述数据存储设备可以执行所述第二请求对应的任务。
  20. 根据权利要求19所述的区块链平台设备，其特征在于，所述区块链平台设备还包括：
    第三接收模块，用于接收所述数据存储设备发送的响应信息，所述响应信息指示所述数据存储设备已经执行所述第二请求对应的任务；
    记入模块，用于根据所述响应消息将所述数据存储设备已经执行所述第二请求对应的任务记入分布式账本。
  21. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令或代码，当所述指令在计算机上执行时，使得所述计算机执行如权利要求1-5任一项所述的方法。
  22. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令或代码，当所述指令在计算机上执行时，使得所述计算机执行如权利要求6-8任一项所述的方法。
  23. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令或代码，当所述指令在计算机上执行时，使得所述计算机执行如权利要求9-11任一项所述的方法。
  24. 一种计算机程序产品，其特征在于，所述计算机程序包括程序代码，当所述计算机程 序代码被计算机运行时，使得所述计算机执行如权利要求1-5任一项所述的方法。
  25. 一种计算机程序产品，其特征在于，所述计算机程序包括程序代码，当所述计算机程序代码被计算机运行时，使得所述计算机执行如权利要求6-8任一项所述的方法。
  26. 一种计算机程序产品，其特征在于，所述计算机程序包括程序代码，当所述计算机程序代码被计算机运行时，使得所述计算机执行如权利要求9-11任一项所述的方法。
  27. 一种用户数据管理系统，其特征在于，所述用户数据管理系统包括权利要求12-15任一项所述的数据请求设备、权利要求16-18任一项所述的数据存储设备和权利要求19-20任一项所述的区块链平台设备。
PCT/CN2022/091117 2021-06-04 2022-05-06 一种用户数据管理方法以及相关设备 WO2022252912A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP22814959.7A EP4328774A1 (en) 2021-06-04 2022-05-06 User data management method and related device
BR112023024508A BR112023024508A2 (pt) 2021-06-04 2022-05-06 Método de gerenciamento de dados de usuário e dispositivo relativo
US18/525,908 US20240097917A1 (en) 2021-06-04 2023-12-01 User data management method and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110626638.6 2021-06-04
CN202110626638.6A CN115438336A (zh) 2021-06-04 2021-06-04 一种用户数据管理方法以及相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/525,908 Continuation US20240097917A1 (en) 2021-06-04 2023-12-01 User data management method and related device

Publications (1)

Publication Number Publication Date
WO2022252912A1 true WO2022252912A1 (zh) 2022-12-08

Family

ID=84272220

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/091117 WO2022252912A1 (zh) 2021-06-04 2022-05-06 一种用户数据管理方法以及相关设备

Country Status (5)

Country Link
US (1) US20240097917A1 (zh)
EP (1) EP4328774A1 (zh)
CN (1) CN115438336A (zh)
BR (1) BR112023024508A2 (zh)
WO (1) WO2022252912A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017054985A1 (en) * 2015-09-30 2017-04-06 British Telecommunications Public Limited Company Access control
CN107103252A (zh) * 2017-04-27 2017-08-29 电子科技大学 基于区块链的数据访问控制方法
US20200358801A1 (en) * 2019-05-08 2020-11-12 International Business Machines Corporation Threat information sharing based on blockchain
US20210021577A1 (en) * 2019-07-17 2021-01-21 AO Kaspersky Lab Systems and methods for sending user data from a trusted party to a third party using a distributed registry

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017054985A1 (en) * 2015-09-30 2017-04-06 British Telecommunications Public Limited Company Access control
CN107103252A (zh) * 2017-04-27 2017-08-29 电子科技大学 基于区块链的数据访问控制方法
US20200358801A1 (en) * 2019-05-08 2020-11-12 International Business Machines Corporation Threat information sharing based on blockchain
US20210021577A1 (en) * 2019-07-17 2021-01-21 AO Kaspersky Lab Systems and methods for sending user data from a trusted party to a third party using a distributed registry

Also Published As

Publication number Publication date
US20240097917A1 (en) 2024-03-21
BR112023024508A2 (pt) 2024-02-15
CN115438336A (zh) 2022-12-06
EP4328774A1 (en) 2024-02-28

Similar Documents

Publication Publication Date Title
JP6262278B2 (ja) アクセス制御クライアントの記憶及び演算に関する方法及び装置
US9444849B2 (en) Enforcing policy compliance on a device
US20210329453A1 (en) Blockchain based wireless access point password management
US8239674B2 (en) System and method of protecting files from unauthorized modification or deletion
TWI475899B (zh) 用以儲存電子存取用戶之設備及方法
JP5964501B2 (ja) 多要素認証を実施するためのシステム及び方法
US10354068B2 (en) Anonymized application scanning for mobile devices
JP6875482B2 (ja) レガシー統合のためのコンピュータ読み取り可能な記憶媒体ならびにそれを使用するための方法およびシステム
JP2015512209A (ja) 複数のアクセス制御クライアントをサポートするモバイル装置、及び対応する方法
US11665532B2 (en) Securing private wireless gateways
TW201338606A (zh) 網路輔助之詐欺偵測裝置及方法
CN101986598B (zh) 认证方法、服务器及系统
JP2015523637A (ja) 分散オペレーティングシステムの物理リソースの管理
WO2019056971A1 (zh) 一种鉴权方法及设备
WO2023115913A1 (zh) 认证方法、系统、电子设备和计算机可读存储介质
US20240086562A1 (en) User data management method and related device
US20210377732A1 (en) Techniques for secure authentication of the controlled devices
US11861582B2 (en) Security protection of association between a user device and a user
WO2017210914A1 (zh) 传输信息的方法和装置
JP2023517531A (ja) 認可されていないファイル変更からフォルダを保護するためのシステム及び方法
WO2023273279A1 (zh) 机器人网络认证系统及方法
US20230135920A1 (en) Network device authentication
WO2022252912A1 (zh) 一种用户数据管理方法以及相关设备
US20220353081A1 (en) User authentication techniques across applications on a user device
WO2022105424A1 (zh) 游戏登录方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22814959

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022814959

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022814959

Country of ref document: EP

Effective date: 20231123

WWE Wipo information: entry into national phase

Ref document number: 2023574498

Country of ref document: JP

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112023024508

Country of ref document: BR

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 112023024508

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20231123