WO2024092928A1 - Procédé et appareil de mise en réseau multi-instance basé sur une chaîne de blocs, et dispositif électronique - Google Patents

Procédé et appareil de mise en réseau multi-instance basé sur une chaîne de blocs, et dispositif électronique Download PDF

Info

Publication number
WO2024092928A1
WO2024092928A1 PCT/CN2022/135245 CN2022135245W WO2024092928A1 WO 2024092928 A1 WO2024092928 A1 WO 2024092928A1 CN 2022135245 W CN2022135245 W CN 2022135245W WO 2024092928 A1 WO2024092928 A1 WO 2024092928A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
service
program instance
service program
blockchain
Prior art date
Application number
PCT/CN2022/135245
Other languages
English (en)
Chinese (zh)
Inventor
于源
孙善禄
王天雨
方唯振
Original Assignee
蚂蚁区块链科技(上海)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2024092928A1 publication Critical patent/WO2024092928A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/63—Routing a service request depending on the request content or context
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of this specification relate to the field of blockchain technology, and in particular to a multi-instance networking method and device and electronic device based on blockchain.
  • the data security blockchain (abbreviated as Data Security Chain) is a widely used solution based on blockchain technology to ensure the secure transfer of user data.
  • Data Security Chain is a widely used solution based on blockchain technology to ensure the secure transfer of user data.
  • user data can be transferred across domains in the form of ciphertext between multiple cross-domain data collaboration parties (data sources), but the control of user data is not transferred.
  • the embodiments of this specification provide a multi-instance networking method, device, and electronic device based on blockchain.
  • a multi-instance networking method based on blockchain is provided, and the method is applied to a data collaboration platform based on a data security blockchain;
  • the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively;
  • the method includes: receiving an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party; in response to the access request, adding the at least one service device to the data security blockchain as a blockchain node, and creating a first service program instance associated with at least one service device corresponding to the first data collaboration party; and determining whether a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties is created; if so, creating a data synchronization channel between the first service program instance and the second service program instance; wherein the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to
  • a multi-instance networking device based on blockchain is provided, and the device is applied to a data collaboration platform based on a data security blockchain;
  • the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively;
  • the device includes: a receiving unit, receiving an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party; a responding unit, in response to the access request, adding the at least one service device as a blockchain node to the data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaboration party; a determining unit, determining whether a service program instance associated with the multiple data collaboration parties is created a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties; a networking unit, upon creating a second service program instance associated with at least one service device
  • an electronic device comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured as any one of the above-mentioned multi-instance networking methods based on blockchain.
  • the embodiments of the present specification create an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and create a data synchronization channel between the service program instances created for each data collaboration party, so that each data collaboration party connected to the data collaboration platform can synchronize data with other data collaboration parties in real time based on the data synchronization channel when there is a need to transfer the encrypted data of the maintained user data to other data collaboration parties across domains.
  • FIG. 1 is a diagram of a network service architecture using multi-instance networking in a data collaboration platform provided in an embodiment of the present specification.
  • FIG2 is a flowchart of a multi-instance networking method based on blockchain provided in an embodiment of this specification.
  • FIG. 3 is a schematic diagram of a device registration process in a service program example provided in an embodiment of this specification.
  • FIG. 4 is a schematic diagram of a device update process in a service program example provided in an embodiment of this specification.
  • FIG. 5 is a schematic diagram of a data registration process in a service program example provided in an embodiment of this specification.
  • FIG. 6 is a schematic diagram of a data update process in a service program example provided in an embodiment of this specification.
  • FIG. 7 is a schematic diagram of a data downlink process in a service program example provided in an embodiment of the present specification.
  • FIG8 is a flow chart of a method for cross-domain data authorization provided in an embodiment of the present specification.
  • FIG. 9 is a schematic diagram of cross-domain data authorization provided in an embodiment of this specification.
  • FIG. 10 is a schematic diagram of cross-domain data transfer provided in an embodiment of this specification.
  • FIG11 is a hardware structure diagram of a multi-instance networking or data cross-domain authorization device based on blockchain provided in an embodiment of this specification.
  • FIG12 is a module of a multi-instance networking device based on blockchain provided in an embodiment of this specification.
  • FIG. 13 is a module of a data cross-domain authorization device provided in an embodiment of this specification.
  • first, second, third, etc. may be used in this specification to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • word “if” as used herein may be interpreted as "at the time of” or "when” or "in response to determining”.
  • Data security blockchain (abbreviated as data security chain) is a network service architecture that uses blockchain as the underlying service.
  • the blockchain nodes on the blockchain as the underlying service can usually include service devices corresponding to multiple data collaboration parties.
  • the multiple data collaboration parties usually correspond to different data domains respectively. It should be noted that the multiple data collaboration parties correspond to different data domains respectively, which specifically means that the service devices corresponding to the multiple data collaboration parties need to carry out cross-domain data transmission and communication.
  • different service devices can usually access the user data stored in the local database of other service devices through the domain name access address (i.e., URL address).
  • URL address domain name access address
  • a service device accesses another service device through the URL address, if the URL address of the accessed service device is different from the URL address of the service device that initiated the access, then the data transmission and communication between the two service devices is called cross-domain.
  • the multiple service devices can share the same domain name access address.
  • the user data maintained by each data collaborator is usually stored in the local database of the service device corresponding to each data collaborator.
  • the blockchain can only store the data attribute information (also called data directory) corresponding to the user data maintained by each data collaborator.
  • any data collaborator can find the user data published by other data collaborators who have joined the data security blockchain by obtaining the data attribute information on the blockchain.
  • the data collaborator finds the user data of interest published by other data collaborators, it can also initiate a data authorization application to the other data collaborator, and the owner of the user data requesting authorization will conduct the authorization approval.
  • the encrypted data of the user data can be transferred across domains to the data collaborator through the data synchronization channel between the data collaborators.
  • the solution based on the existing data security blockchain can ensure that the control of user data is not transferred while transferring user data across domains in the form of ciphertext.
  • the existing data collaboration platform based on the data security blockchain usually adopts a centralized network service architecture based on a single service program instance.
  • the data collaboration platform can utilize the resources on the blockchain service platform to jointly create a centralized service program instance for the multiple data collaborators on the data collaboration platform, and authorize the cross-domain transfer of ciphertext data of user data maintained by the multiple data collaborators through the centralized service program instance.
  • the service program instance can be a software service unit created on the blockchain service platform using resources on the blockchain service platform to provide services to the multiple data collaborators.
  • the centralized service program instance can be associated with all service devices that have joined the data security blockchain as blockchain nodes, and authorize the cross-chain transfer of encrypted data of user data stored in the local databases of all service devices associated with it.
  • any data agreement party among the above-mentioned multiple data collaborators if discovering the user data of interest published by other data collaborators, can initiate a data authorization application to the centralized service program instance, and the service program instance will conduct authorization and approval.
  • this specification proposes a distributed network service architecture that uses multiple service program instances for networking on a data collaboration platform based on a data security blockchain.
  • a centralized network service architecture based on a single service program instance may no longer be used.
  • the resources on the data collaboration platform can be used to create a service program instance associated with at least one service device corresponding to each data collaboration party, and create a data synchronization channel between the service program instances corresponding to each data collaboration party, and synchronize data between the data collaboration parties through the data synchronization channel.
  • the data collaboration platform since the above-mentioned data collaboration party platform no longer adopts a centralized network service architecture based on a single service program instance, but adopts a network service architecture based on networking of multiple service program instances, the data collaboration platform will create an independent service program instance for each data collaboration party connected to the data collaboration platform, and create a data synchronization channel between the service program instances created for each data collaboration party, so that each data collaboration party connected to the data collaboration platform, when there is a need to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, can synchronize data with other data collaboration parties in real time based on the data synchronization channel, thereby meeting the data synchronization needs in the data collaboration alliance formed based on the data collaboration relationship.
  • each data collaborator can only discover data sets published by other data collaborators by periodically obtaining data attribute information corresponding to data sets published by other data collaborators from the data security chain.
  • This method obviously has a lag.
  • data collaborators who are data users they cannot perceive the latest data published by other data collaborators in the first place; similarly, for data collaborators who are data providers, they cannot promptly notify other data collaborators of the latest data they have published.
  • the network service architecture based on multiple service program instances in the above technical solution is adopted, since an independent service program instance is created for each data collaborator on the data collaboration platform, and a data synchronization channel is opened between the service instances corresponding to each data collaborator. Therefore, after the data collaborator as the data provider publishes the latest data on the data security blockchain, the evidence identification of the published data on the data security blockchain can be synchronized to the corresponding service program instances of other data collaborators in a timely manner through the data synchronization channel.
  • FIG. 1 is a diagram of a network service architecture using multi-instance networking in a data collaboration platform as shown in this specification.
  • the data collaboration platform may no longer adopt a centralized network service architecture based on a single service program instance, but may adopt a distributed network service architecture in which multiple service program instances are networked.
  • the first service program instance shown in Figure 1 can be a service program instance created by the above-mentioned data collaboration platform for a first data collaboration party accessing the data collaboration platform, and associated with a service device corresponding to the first data collaboration party.
  • the second service program instance shown in Figure 1 can be a service program instance created by the above-mentioned data collaboration platform for a second data collaboration party accessing the data collaboration platform, and associated with a service device corresponding to the second data collaboration party.
  • each data collaboration party connected to the data collaboration platform can correspond to one service device or multiple service devices.
  • the service device corresponding to the data collaboration party will be added to the digital security blockchain as a blockchain node; for example, as shown in Figure 1, the service devices corresponding to the first data collaboration party include multiple devices, namely service devices 1 to service devices 4; the service device corresponding to the second data collaboration platform includes one device, namely service device 5.
  • the above service program instance may specifically adopt a three-layer service architecture as shown in FIG. 1 , which includes a first service layer, a second service layer and a third service layer.
  • the first service layer may be an application service layer corresponding to the digital security blockchain.
  • the second service layer may be an authorization service layer corresponding to the digital security blockchain.
  • the third service layer can be the basic service layer corresponding to the digital security blockchain.
  • service layer among the above three service layers, it can include some basic service components provided on the data collaboration platform.
  • the above three service layers may include service components such as SLB (Server Load Balancer) and ECS (Elastic Compute Service).
  • SLB Server Load Balancer
  • ECS Elastic Compute Service
  • the application service layer may specifically include a cross-domain transfer component for implementing the function of cross-domain transfer of ciphertext data, an encryption and decryption component for implementing the encryption and decryption functions for ciphertext data, and the like.
  • the cross-domain transfer component and the encryption and decryption component may both be cloud components implemented based on cloud computing resources related to the ECS service on the cloud service platform.
  • the above-mentioned authorization service layer may specifically include a dataAuth (data authorization) component for implementing authorization management for cross-domain transfer of encrypted data, a DIS (Decentralized Identity Service) component for implementing management of blockchain digital identities for user data on the digital security blockchain, and a transit service component for implementing data transfer for data stored on the digital security blockchain and obtaining data from the digital security blockchain at a regular interval, etc.
  • a dataAuth data authorization
  • DIS Decentralized Identity Service
  • transit service component for implementing data transfer for data stored on the digital security blockchain and obtaining data from the digital security blockchain at a regular interval, etc.
  • the data collaboration platform is a cloud service platform
  • the dataAuth, DIS components and the transit service may all be cloud components implemented based on cloud computing resources related to the ECS service on the cloud service platform.
  • the above-mentioned basic service layer can be used to implement basic service functions related to digital security blockchain; for example, service functions such as data on-chain storage.
  • each blockchain node on the data security blockchain i.e., the service device corresponding to each data collaboration party
  • can be a virtual service device such as a virtual machine created based on the cloud computing resources related to the ECS service on the cloud service platform.
  • the application service layer and the authorization service layer may include several databases in addition to several service components.
  • the database types of the databases included in the application service layer and the authorization service layer are not specifically limited in this specification.
  • the database types may include MySQL, Redis, OSS, SqlLite, etc.
  • the database on the above application service layer can be used as a local database on the service device corresponding to the data collaboration party, and can be used to store user data that needs to be transferred across domains.
  • the database on the above authorization service layer can include databases corresponding to each service component on the authorization service layer; for example, as shown in Figure 1, the authorization service layer can include a database corresponding to the dataAuth component and the DIS component, and can also include a database corresponding to the transit service component.
  • the database corresponding to the dataAuth component and the DIS component can be used to store data related to data authorization for cross-domain transfer of user data.
  • the database corresponding to the transit service component can be used to store data that the component obtains from the digital security blockchain on a regular basis.
  • a data synchronization channel may be created between the first service program instance and the second service program instance for real-time data synchronization between the service program instances.
  • the data synchronization channel may be a service call channel created between the service program instances based on the call address of the service program instance (such as the domain name access address of the service device associated with the service program instance).
  • the multiple service layers shown in Figure 1 can be merged into one service layer, or a service layer shown in Figure 1 can be further split into multiple service layers, or the multiple components shown in Figure 1 can be merged into one component according to their functions, or a component shown in Figure 1 can be further divided and split into multiple components according to its functions, and so on. Examples will not be given one by one in this specification.
  • the second data collaboration party shown in FIG1 when the second data collaboration party shown in FIG1 does not allow the ciphertext data of the user data stored on the service device corresponding to the second data collaboration party to be transferred across domains to other data collaboration parties, the second data collaboration party can only serve as a data user, but not as a data provider.
  • the dataAuth component and the DIS component shown in FIG1 may not be included in the above-mentioned second service program instance corresponding to the second data collaboration party.
  • Figure 2 is a flowchart of a multi-instance networking method based on blockchain shown in this specification according to an exemplary embodiment.
  • the method can be applied to a data collaboration platform based on a data security blockchain that adopts the network service architecture shown in Figure 1; the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively; the user data maintained by each data collaboration party is respectively stored in the local database of the service device corresponding to each data collaboration party; the data attribute information corresponding to the user data maintained by each data collaboration party is stored on the data security blockchain; the method includes steps 210 to 240.
  • Step 210 Receive an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party.
  • the above-mentioned data collaboration platform can be a cloud service platform; for example, in one example, the above-mentioned data collaboration platform can be a blockchain cloud service platform.
  • the above-mentioned blockchain cloud service platform can be a BaaS platform (also referred to as BaaS cloud) for providing blockchain as a service (BaaS, Blockchain as a Service).
  • BaaS also referred to as BaaS cloud
  • the BaaS platform can provide easy-to-use, one-click deployment, fast verification, flexible and customizable blockchain services for service devices coupled to the BaaS platform by providing pre-written software for activities occurring on the blockchain, thereby accelerating the development, testing, and launch of blockchain business applications, and helping the implementation of blockchain business application scenarios in various industries.
  • the above-mentioned service device can be a local service device deployed by the data collaborator, or it can be a virtual service device created for the data collaborator by using cloud computing resources on a cloud service platform.
  • the service device corresponding to the data collaborator can be a VM virtual machine created for the data collaborator by the cloud service platform, which is created by the cloud service platform using cloud computing resources such as computing resources, storage resources, and transmission resources on the cloud service platform.
  • the first data collaboration party When the first data collaboration party wants to transfer the encrypted data of user data across domains to other data collaboration parties, or wants to obtain the encrypted data of user data maintained by other data collaboration parties that have been connected to the above-mentioned data collaboration platform across domains, it can specifically initiate an access request to the data collaboration platform; wherein, the access request can specifically include the device identifier of at least one service device corresponding to the first data collaboration party.
  • Step 220 In response to the access request, the at least one service device is added to the data security blockchain as a blockchain node, and a first service program instance associated with the at least one service device corresponding to the first data collaboration party is created.
  • the data collaboration platform can respond to the access request and add at least one service device corresponding to at least one device identifier included in the access request as a blockchain node to the digital security blockchain network.
  • the blockchain collaboration platform can also use the resources on the data collaboration platform to create a first service program instance on the data collaboration platform that is associated with at least one service device corresponding to the first data collaboration party.
  • Step 230 determining whether a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties except the first data collaboration party is created.
  • the data collaboration platform can further determine whether to create a second service program instance associated with at least one service device corresponding to the second data collaboration party for the second data collaboration party connected to the data collaboration platform in the same manner.
  • Step 240 if yes, create a data synchronization channel between the first service program instance and the second service program instance; wherein the multiple data collaborators correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used to perform authorization management on the cross-chain transfer of encrypted data corresponding to user data stored on the service device associated with it.
  • the data collaboration platform determines that a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties has been created, the data collaboration platform can further create a data synchronization channel between the first service program instance and the second service program instance.
  • the data synchronization channel can be specifically used for cross-domain data synchronization between the first service program instance and the second service program instance.
  • the networking between the first data collaboration party and the second data collaboration party is completed. Subsequently, the first service program instance and the second service program instance can perform real-time cross-domain data synchronization based on the data synchronization channel.
  • the second data collaborator here may refer to other data collaborators other than the first data collaborator, and the other data collaborators may be one or more.
  • the second service program instance may also refer to other service program instances created by the data collaboration platform for other data collaborators other than the first data collaborator, and the other service program instances may be one or more.
  • the data collaboration platform can respectively create data synchronization channels between the first service program instance and multiple service program instances created for the multiple other data collaboration parties to complete the networking between the first data collaboration party and the above-mentioned multiple other data collaboration parties.
  • the data collaboration platform creates service program instances for each connected data collaboration party, and roles may also be divided according to the main service program instance and the slave service program instance.
  • a data collaboration alliance is initiated by the operator of the data security blockchain.
  • the operator can serve as the first data collaborator of the data collaboration alliance.
  • the service program instance created for the operator and associated with at least one service device of the operator can serve as the main service program instance in the data collaboration alliance, and the service program instances created for other data collaborators (such as institutions) that subsequently join the data collaboration alliance can serve as slave service program instances in the data collaboration alliance.
  • the data collaboration platform is a data synchronization channel between service program instances created with each data collaboration party, and specifically may be a service call channel created between service program instances based on a call address of the service program instance.
  • the type of the above-mentioned calling address is not particularly limited in this specification.
  • a domain name access address (ie, URL address) shared by at least one service device corresponding to each service program instance may be used as the calling address corresponding to each service program instance.
  • the service calling channel between each service program instance may be an http calling channel constructed between each service program instance based on a domain name access address shared by at least one service device corresponding to each service program instance.
  • the above-mentioned calling address may be in other forms such as an interface calling address, and the service calling channel between various service program instances may be an interface calling channel, which will not be listed one by one in this specification.
  • the service calling channel between the first service program instance and the second service program can usually include a first service calling channel formed based on the calling address of the second service program instance maintained by the first service program instance, with the first service program instance as the calling initiator and the second service program instance as the called party; and a second service calling channel formed based on the calling address of the first service program instance maintained by the second service program instance, with the second service program instance as the calling initiator and the first service program instance as the called party.
  • the dataAuth component located in the authorization service layer is functionally distinguished and is usually a core component in a service program instance; therefore, in this case, when creating a data synchronization channel between a first service program instance and a second service program instance, the url address of the second service program instance can be specifically added to the dataAuth component of the first service program instance for maintenance, so as to form a first http call channel between the dataAuth component of the first service program instance and the second service program instance.
  • the url address of the first service program instance can be added to the dataAuth component of the second service program instance for maintenance, so as to form a second http call channel between the dataAuth component of the second service program instance and the first service program instance, so as to complete the creation of the data synchronization channel between the first service program instance and the second service program instance.
  • real-time data synchronization can be performed between the first service program instance and the second service program instance based on the data synchronization channel.
  • the following describes in detail the data synchronization process between the first service program instance and the second service program instance in conjunction with a specific data synchronization scenario.
  • the first data collaborator when the first data collaborator needs to add a new service device, the first data collaborator can initiate device registration to the first service program instance, associate the newly added service device with the first service program instance, and after the association is completed, the first service program instance synchronizes the device information of the newly added service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the device information of the service device newly added in the first service program instance.
  • the first service program instance receives a device registration request; wherein the device registration request includes the device information of the service device newly added by the first data collaboration party; in response to the device registration request, the first service program instance establishes an association relationship between the newly added service device and the first service program instance, and stores the device information of the newly added service device and the association relationship in a database corresponding to the first service program instance; then, further calling the DataAuth component in the first service program instance, and the DataAuth component further calls the DIS component in the first service program instance, and the DIS component creates digital identity information for the newly added service device on the data security blockchain, and returns the created digital identity information to the DataAuth component.
  • the DataAuth component further initiates a service call for the first service program instance (i.e., the callback call in Figure 3) based on the maintained calling address of the first service program instance, so as to return the digital identity information of the newly added service device to the first service program instance, and store it in the database corresponding to the first service program instance, that is, store the digital identity information.
  • a service call for the first service program instance i.e., the callback call in Figure 3
  • the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the digital identity information and device information of the newly added service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, and synchronize and store them in the database corresponding to the second service program instance, that is, store the digital identity information and device information.
  • the DIS component creates digital identity information for the newly added service device on the data security blockchain, which may include: the DIS component calls the smart contract deployed on the data security blockchain to create digital identity information for the newly added service device on the data security blockchain.
  • the first data collaborator when the first data collaborator needs to update any target service device associated with the first service program instance, the first data collaborator can initiate a blockchain device update to the first service program instance, update the device information of the target service device in the database corresponding to the first service program instance, and synchronize the updated device information of the target service device to the second service program instance through the data synchronization channel between the first data collaborator and the second service program instance.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the updated device information of the target service device in the first service program instance.
  • the first service program instance receives a blockchain device update request; wherein the blockchain device update request includes the device information to be updated of any target service device associated with the first service program instance; in response to the blockchain device update request, the first service program instance updates the device information of the target service device stored in the database corresponding to the first service program instance based on the device information to be updated; then, further calling the DataAuth component in the first service program instance, and the DataAuth component further calls the DIS component in the first service program instance, and the DIS component updates the digital identity information of the target service device on the data security blockchain, and returns the updated digital identity information to the DataAuth component.
  • the DataAuth component further initiates a service call to the first service program instance based on the maintained calling address of the first service program instance, so as to return the updated digital identity information to the first service program instance, and store the updated digital identity information of the target service device in the database corresponding to the first service program instance.
  • the DataAuth component can also initiate a service call to the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the updated device information and updated digital identity information of the target service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, and synchronously update the device information of the target service device stored in the database corresponding to the second service program instance, that is, store the updated device information and updated digital identity information of the target service device.
  • the DIS component updates the digital identity information of the target service device on the data security blockchain, which may include: the DIS component calls the smart contract deployed on the data security blockchain to create new digital identity information for the target service device on the data security blockchain, and associates the new digital identity information with the old digital identity information of the target service device.
  • the created new digital identity information is the updated digital identity information of the target service device.
  • the first data collaborator when the first data collaborator needs to publish a data set consisting of user data stored in a local database, the first data collaborator can initiate data registration to the first service program instance, generate data attribute information corresponding to the data set, and after storing the data attribute information in the data security blockchain (the blockchain storage identifier corresponding to the data attribute information can be obtained), the first service program instance synchronizes the blockchain storage identifier to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain storage identifier.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the blockchain evidence identifier corresponding to the data attribute information.
  • the first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes the data set requested to be registered by the target service device; in response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information in the local database of the target service device; then, the DataAuth component in the first service program instance is further called, and the DataAuth component publishes the data attribute information corresponding to the data set to the data security blockchain for storage, so as to obtain a blockchain storage identifier for querying the data attribute information on the chain from the data security blockchain.
  • the DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the blockchain evidence identifier and the data attribute information to the first service program instance, and store them in a database corresponding to the first service program instance, i.e., the blockchain evidence identifier and the data attribute information are stored in an associated manner.
  • the first service program instance calls the DataAuth component in the first service program instance
  • the DataAuth component calls the DIS component in the first service program instance
  • the DIS component further creates digital identity information including the corresponding blockchain evidence identifier for the data attribute information corresponding to the data set on the data security blockchain, and returns the created digital identity information to the DataAuth component.
  • the DIS component can create digital identity information including the blockchain evidence identifier on the data security blockchain for the data attribute information by calling the smart contract deployed on the data security blockchain.
  • the DataAuth component initiates a service call to the first service program instance based on the maintained calling address of the first service program instance, so as to return the digital identity information of the data attribute information to the first service program instance, and store it in the database corresponding to the first service program instance, that is, to store the digital identity information of the data attribute information.
  • the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the digital identity information of the data attribute information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance; so that the second service program instance can obtain the data attribute information from the data security blockchain based on the blockchain evidence identifier contained in the digital identity information, and synchronously store the obtained data attribute information in the database corresponding to the second service program instance.
  • the first data collaborator when the first data collaborator needs to update a published data set, the first data collaborator can initiate a data update to the first service program instance, generate updated data attribute information corresponding to the updated data set, and after storing the updated data attribute information in the data security blockchain (the blockchain storage identifier corresponding to the updated data attribute information can be obtained), the first service program instance synchronizes the blockchain storage identifier corresponding to the updated data attribute information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain storage identifier.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the blockchain evidence identifier corresponding to the updated data attribute information.
  • Figure 6 a schematic diagram of a data update process in a service program instance.
  • the first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes a data set requested to be updated by the target service device; in response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in the local database of the target service device; then, the DataAuth component in the first service program instance is further called, and the DataAuth component publishes the updated data attribute information corresponding to the data set to the data security blockchain for storage, so as to obtain a blockchain storage identifier for querying the updated data attribute information from the data security blockchain.
  • the DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the blockchain evidence identifier and the updated data attribute information to the first service program instance, and store them in a database corresponding to the first service program instance, i.e., the blockchain evidence identifier and the updated data attribute information are stored in association with each other.
  • the first service program instance calls the DataAuth component in the first service program instance
  • the DataAuth component calls the DIS component in the first service program instance
  • the DIS component further updates the data identity information of the updated data attribute information corresponding to the data set on the data security blockchain, and returns the updated digital identity information to the DataAuth component.
  • the DIS component can call the smart contract deployed on the data security blockchain to create new digital identity information on the data security blockchain for the updated data attribute information, and associate the new digital identity information with the old digital identity information of the data attribute information before the update.
  • the new digital identity information created is the updated digital identity information of the data set.
  • the DataAuth component initiates a service call to the first service program instance based on the maintained calling address of the first service program instance, so as to return the updated digital identity information to the first service program instance, and store it in the database corresponding to the first service program instance, that is, to store the updated digital identity information.
  • the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the updated digital identity information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance; so that the second service program instance can obtain the updated data attribute information from the data security blockchain based on the blockchain evidence identifier contained in the updated digital identity information, and synchronously update the obtained updated data attribute information in the database corresponding to the second service program instance.
  • the first data collaborator when the first data collaborator needs to delete the published target data set, the first data collaborator can initiate a data downlink to the first service program instance, delete the target data set and the data attribute information of the target data set stored in the local database, and the first service program instance synchronizes the deletion notification of the target data set to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance synchronously deletes the target data set.
  • the data attribute information of the target data set is synchronized between the first service program instance and the second service program instance through the data synchronization channel.
  • the first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes the data set identifier of the target data set requested to be deleted by the target service device; in response to the data deletion request, the first service program instance deletes the target data set and the data attribute information of the target data set stored in the local database of the target service device; then, the DataAuth component in the first service program instance is further called, and the DataAuth component sets the data identity information created by the data attribute information of the data set to an invalid state on the data security chain to obtain the setting result.
  • the DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the setting result to the first service program instance, and switch the state of the data set and data attribute information to a third state in the database corresponding to the first service program instance.
  • the DataAuth component can also initiate a service call to the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the deletion notification of the target data set to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance based on the deletion notification for deletion processing, and set the data identity information maintained in the database to an invalid state.
  • the blockchain-based multi-instance networking embodiment creates an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and creates a data synchronization channel between the service program instances created for each data collaboration party.
  • each data collaboration party connected to the data collaboration platform needs to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, it can synchronize data with other data collaboration parties in real time based on the data synchronization channel.
  • Figure 8 is a flowchart of a cross-domain data authorization method shown in this specification according to an exemplary embodiment.
  • the method can be applied to a data collaboration platform based on a data security blockchain that adopts the network service architecture shown in Figure 1;
  • the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively;
  • a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties is created;
  • the service program instance is used to authorize the cross-domain transfer of encrypted data of user data stored on the service device associated with it;
  • the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance;
  • the multiple data collaboration parties correspond to different data domains respectively;
  • the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the
  • Step 310 The first service program instance receives a data authorization request initiated by the second data collaborator through the data synchronization channel for user data maintained by the first data collaborator; wherein the data authorization request includes the data identifier of the target user data for which the second data collaborator requests authorization.
  • This specification creates a data synchronization channel between service program instances created by each data collaborator, so that each data collaborator connected to the data collaboration platform can perform cross-domain data authorization with other data collaborators in real time based on the data synchronization channel when there is a need for data authorization for cross-domain transfer of encrypted data of user data.
  • the blockchain collaboration platform includes a blockchain cloud service platform; and the service devices corresponding to the respective data collaboration parties include virtual service devices created for the respective data collaboration parties on the cloud service platform.
  • the data collaboration platform is a data synchronization channel between service program instances created with various data collaboration parties, for example, it may be a service calling channel created between service program instances based on a calling address of the service program instance.
  • the type of the above-mentioned calling address is not particularly limited in this specification.
  • a domain name access address (ie, URL address) shared by at least one service device corresponding to each service program instance may be used as the calling address corresponding to each service program instance.
  • the service calling channel between each service program instance may be an http calling channel constructed between each service program instance based on a domain name access address shared by at least one service device corresponding to each service program instance.
  • the above-mentioned calling address may be in other forms such as an interface calling address, and the service calling channel between various service program instances may be an interface calling channel, which will not be listed one by one in this specification.
  • the step 310 may include: in response to a service call initiated by the second service program instance based on the first calling address of the first service program instance maintained, to the first service program instance, obtaining a data authorization request for user data maintained by the first data collaborator carried in the calling parameters corresponding to the service call.
  • the service calling channel between the first service program instance and the second service program can usually include a first service calling channel formed based on the calling address of the second service program instance maintained by the first service program instance, with the first service program instance as the calling initiator and the second service program instance as the called party; and a second service calling channel formed based on the calling address of the first service program instance maintained by the second service program instance, with the second service program instance as the calling initiator and the first service program instance as the called party.
  • the second data collaborator When the second data collaborator has a data authorization requirement for the cross-domain transfer of encrypted data of user data published by the first data collaborator, it can initiate a data authorization request for the user data maintained by the first data collaborator to the first service program instance corresponding to the first data collaborator through the data synchronization channel; wherein the data authorization request includes the data identifier of the target user data for which the second data collaborator requests authorization.
  • Step 320 The first service program instance responds to the data authorization request, authorizes the cross-domain transfer authority of the encrypted data of the target user data to the second data collaborator, and returns the authorization result to the second service program instance through the data synchronization channel.
  • the DataAuth component in the first service program instance is called in response to the data authorization request, and the DataAuth component authorizes the cross-domain transfer authority of the encrypted data of the target user data to the second data collaboration party, and returns the authorization result (such as the authorization certificate in Figure 9) to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.
  • the first data collaboration party configures an authorization approval process for the maintained user data; wherein the approval process includes at least one approver designated by the first data collaboration party.
  • the first service program instance responds to the data authorization request and authorizes the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator, including: the first service program instance responds to the data authorization request, obtains the authorization approval process configured by the first data collaborator for the target user data, and triggers the execution of the authorization approval process, and in response to the approval of each approver included in the authorization approval process, generates an authorization credential for the second data collaborator to authorize the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator.
  • each approver can generate five approval statuses: pending approval, approved, rejected, revoked, and approval-free; among them, revocation can be initiated by the applicant of the authorization approval process (such as the second data collaboration party) at any time before the end of the authorization approval process.
  • the revoked authorization approval process is terminated immediately, and the approval result is revoked approval.
  • the authorization approval process if the status of the authorization approval process obtained by the current approver is pending approval, the authorization approval process will be suspended and it will be necessary to wait for the current approver to upload the approval result (one of approval, rejection, and exemption from approval) before continuing to execute; if the uploaded result is rejection, the authorization approval process will be terminated immediately, and the approval result of rejection will be notified to the applicant. If the uploaded result is approval or exemption from approval, determine whether there is the next approver according to the order of the authorization approval process. If there is, the next approver will become the new current approver and switch to the pending approval status; if not, the authorization approval process will be terminated, and the approval result will be that all approvers have approved.
  • the first data collaborator can specify the authorization approval process
  • the application approval process may include a default process, a custom process, and an approval-free process, etc.; among them, the default process may refer to the second data collaborator as the approving party to approve first, and then the first data collaborator as the approving party to approve; the custom process may be an approval process customized by the first data collaborator.
  • the first service program instance calls the DataAuth component in the first service program instance, and the DataAuth component performs authorization processing to generate an authorization credential for the second data collaborator to authorize the cross-domain transfer authority of the encrypted data of the target user data to the second data collaborator.
  • returning the authorization result to the second service program instance through the data synchronization channel may include: initiating a service call for the second service program instance based on the maintained second calling address of the second service program instance, and synchronizing the authorization credential to the second service program instance as a calling parameter.
  • the method before synchronizing the authorization credential to the second service program instance, the method further includes: publishing the authorization credential to the data security blockchain for evidence storage. Accordingly, synchronizing the authorization credential as a call parameter to the second service program instance includes: synchronizing the evidence identification of the authorization credential on the data security blockchain as a call parameter to the second service program instance, so that the second service program instance obtains the authorization credential from the data security blockchain based on the evidence identification.
  • the authorization credential can be published to the data security blockchain for storage by calling the DataAuth component; by storing the authorization credential in the data security blockchain, it is ensured that the authorization credential is not tampered with.
  • the synchronization of the authorization certificate to the second service program instance may include: synchronizing the storage identifier of the authorization certificate on the data security blockchain to the second service program instance, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the storage identifier.
  • the authorization credential before synchronizing the authorization credential to the second service program instance, it may also include: generating, by the DataAuth component, an authorization record for the cross-domain transfer authority of the encrypted data of the target user data, and publishing the generated authorization record to the data security blockchain for evidence storage.
  • the first data collaborator configures data usage rules for the maintained user data; wherein the data usage rules define restriction rules for the use of the user data; the method further includes: in response to a triggered transfer task of transferring the ciphertext data of the target user data across domains to the second data collaborator, generating a usage program for using the target user data based on the data usage rules, and transferring the usage program and the ciphertext data of the target user data to the second service program instance through the data synchronization channel, so that the usage program is run by the second service program instance, and ciphertext calculations are performed on the ciphertext data of the target user data based on the data usage rules contained in the usage program.
  • transferring the encrypted data of the usage program and the target user data to the second service program instance through the data synchronization channel includes: initiating a service call for the second service program instance based on the maintained second calling address of the second service program instance, and transferring the encrypted data of the usage program and the target user data to the second service program instance as calling parameters.
  • the DataAuth component in the first service program instance monitors the authorization record or cross-domain transfer record for the target user data on the data security chain, the above transfer task can be triggered immediately.
  • the transfer task can be triggered when the DataAuth component in the first service program instance monitors the authorization record stored on the data security chain; it can also be triggered when the DataAuth component monitors the transfer record stored on the chain.
  • the DataAuth component here can generate a cross-domain transfer record corresponding to the ciphertext data of the target user data, and publish the generated cross-domain transfer record to the data security chain for evidence storage.
  • the ciphertext data transfer can be performed after the transfer record is successfully uploaded to the chain, or the ciphertext data transfer can be performed first and then the transfer record can be uploaded to the chain for evidence storage; generally, the former method is relatively safer.
  • the data usage rules may include any one or more combinations of the following:
  • Usage mode restriction rules define the types of operations that are restricted when operating on the ciphertext data of the target user data; the types of operations may include allowed calculation methods and processing methods. For example, allow for identical query, allow for fuzzy query, allow for string concatenation, allow for string length, allow for substring truncation, allow for string conversion to lowercase, allow for string conversion to uppercase, etc.
  • the usage limit rule defines the usage limit for the ciphertext data of the target user data when performing operations.
  • Desensitization restriction rules wherein the desensitization restriction rules define a desensitization strategy for the plaintext content corresponding to the ciphertext result obtained by performing ciphertext calculation on the ciphertext data of the target user data.
  • the desensitization strategy may include hash desensitization, shame desensitization, pseudonym desensitization, etc.
  • the usage program includes an SDK program package.
  • the SDK package contains some functions related to the above-mentioned data usage rules. These functions restrict the use of the ciphertext data of the target user data. For example, if it is stipulated that only operation A can be performed on the ciphertext data, then the SDK package only contains calculation functions (operators) related to operation A.
  • the method may also include: the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel; wherein the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the authorization credential; the first service program instance responds to the decryption request, verifies the authorization credential, and in response to the verification of the authorization credential passing, decrypts the ciphertext calculation result to obtain a plaintext calculation result, and based on the desensitization policy defined in the desensitization restriction rules contained in the data usage rules, desensitizes the plaintext calculation result, and synchronizes the desensitized plaintext calculation result to the second service program instance through the data synchronization channel.
  • the second service program instance can perform ciphertext calculations of related services on the ciphertext data under the restrictions of the data usage rules specified by the user program.
  • the calculation result obtained is also a ciphertext calculation result; since the calculation result is a ciphertext, the second service program instance also needs to call the DataAuth component in the second service program instance, and the DataAuth component sends the ciphertext calculation result and the authorization certificate to the first service program instance through the data synchronization channel; then the DataAuth component in the first service program instance verifies the authorization certificate, and after the verification is passed, the DataAuth component further decrypts the ciphertext calculation result, and returns the decrypted plaintext calculation result to the second service program instance through the data synchronization channel.
  • the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel, including: in response to the second service program instance initiating a service call for the first service program instance based on the first calling address of the first service program instance maintained, obtaining the decryption request carried in the calling parameters corresponding to the service call; synchronizing the plaintext calculation result after the desensitization processing to the second service program instance through the data synchronization channel, including: based on the second calling address of the second service program instance maintained, initiating a service call for the second service program instance, and synchronizing the plaintext calculation result after the desensitization processing as a calling parameter to the second service program instance.
  • the data cross-domain authorization implementation example provided in this specification creates an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and creates a data synchronization channel between the service program instances created for each data collaboration party. This allows each data collaboration party connected to the data collaboration platform to synchronize data with other data collaboration parties in real time based on the data synchronization channel when there is a need to transfer the encrypted data of the maintained user data to other data collaboration parties across domains.
  • this specification also provides an embodiment of a multi-instance networking device based on blockchain.
  • the device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer program in the non-volatile memory into the memory and running it. From the hardware level, as shown in Figure 11, it is a hardware structure diagram of the device in which the multi-instance networking device based on blockchain in this specification is located. In addition to the processor, network interface, memory and non-volatile memory shown in Figure 11, the device in the embodiment where the device is located can also include other hardware according to the actual function of data synchronization, which will not be repeated here.
  • Figure 12 is a module diagram of a multi-instance networking device based on blockchain provided in an embodiment of this specification, and the device corresponds to the embodiment shown in Figure 2.
  • the device is applied to a data collaboration platform based on a data security blockchain; the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively; the device includes: a receiving unit 410, receiving an access request initiated by a first data collaboration party; wherein the access request includes the device identification of at least one service device corresponding to the first data collaboration party; a response unit 420, in response to the access request, adding the at least one service device as a blockchain node to the data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaboration party; a determination unit 430, determining whether a service device other than the first data collaboration party among the multiple data collaboration parties has been created.
  • a networking unit 440 when creating a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties except the first data collaboration party, creates a data synchronization channel between the first service program instance and the second service program instance; wherein the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used for cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used for authorizing the cross-chain transfer of ciphertext data corresponding to the user data stored on the service device associated with it.
  • the data synchronization channel includes a service calling channel created between the service program instances based on a calling address of the service program instance.
  • the calling address corresponding to the service program instance includes a domain name access address of a service device associated with the service program instance; and the calling channel includes an http calling channel.
  • the apparatus further includes: a first receiving subunit, wherein the first service program instance receives a device registration request; wherein the device registration request includes device information of a newly added service device of the first data collaboration party; a first responding subunit, wherein in response to the device registration request, the first service program instance establishes an association relationship between the newly added service device and the first service program instance, and stores the device information of the newly added service device and the association relationship in a database corresponding to the first service program instance; and a first synchronization subunit, which initiates a service call for the second service program instance based on a maintained call address corresponding to the second service program instance, synchronizes the device information of the newly added service device to the second service program instance, and synchronizes and stores the information in the database corresponding to the second service program instance.
  • the apparatus further includes: a second receiving subunit, wherein the first service program instance receives a blockchain device update request; wherein the blockchain device update request includes the device information to be updated of any target service device associated with the first service program instance; a second responding subunit, wherein in response to the blockchain device update request, the first service program instance updates the device information of the target service device stored in the database corresponding to the first service program instance based on the device information to be updated; and a second synchronization subunit, which initiates a service call to the second service program instance based on the maintained calling address corresponding to the second service program instance, synchronizes the updated device information of the target service device to the second service program instance, and synchronously updates the device information of the target service device stored in the database corresponding to the second service program instance.
  • the device also includes: a third receiving sub-unit, the first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes a data set requested to be registered by the target service device; a third responding sub-unit, in response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information to a local database of the target service device; and a third synchronizing sub-unit, publishing the data attribute information corresponding to the data set to the data security blockchain for evidence storage, and based on the maintained calling address of the second service program instance, initiating a service call for the second service program instance, synchronizing the blockchain evidence identifier corresponding to the data attribute information to the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain evidence identifier, and synchronously stores the obtained data attribute information in the database corresponding to the second service program instance.
  • the device also includes: a fourth receiving subunit, the first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes a data set requested to be updated by the target service device; a fourth responding subunit, in response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in the local database of the target service device; and a fourth synchronization subunit, the first service program instance publishes the updated data attribute information corresponding to the data set to the data security blockchain for evidence storage, initiates a service call for the second service program instance based on the maintained calling address of the second service program instance, and synchronizes the blockchain evidence identification of the updated data attribute information to the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain evidence identification, and synchronizes the data attribute information corresponding to the data set stored in the database
  • the device also includes: a fifth receiving sub-unit, the first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes a data set identifier of a target data set that the target service device requests to delete; a fifth responding sub-unit, in response to the data deletion request, the first service program instance deletes the target data set and the data attribute information of the target data set stored in a local database of the target service device; a fifth synchronization sub-unit, based on the maintained calling address of the second service program instance, initiates a service call to the second service program instance to synchronize the deletion notification of the target data set to the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance based on the deletion notification for deletion processing.
  • the data deletion request includes a data set identifier of a target data set that the target service device requests to delete
  • a fifth responding sub-unit in
  • the device also includes: the data collaboration platform includes a blockchain cloud service platform; and the service equipment corresponding to each data collaboration party includes a virtual service equipment created for each data collaboration party on the cloud service platform.
  • Figure 13 is a module diagram of a data cross-domain authorization device provided in an embodiment of this specification, and the device corresponds to the embodiment shown in Figure 8.
  • the device is applied to a data collaboration platform based on a data security blockchain;
  • the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively;
  • a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties;
  • the service program instance is used to perform authorization management on the cross-domain transfer of encrypted data of user data stored on the service device associated with it;
  • the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance; and the multiple data collaboration parties correspond to different Data domain;
  • the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance;
  • the data synchronization channel includes a service calling channel created between the service program instances based on a calling address of the service program instance.
  • the calling address corresponding to the service program instance includes a domain name access address of a service device associated with the service program instance; and the calling channel includes an http calling channel.
  • the receiving unit 510 includes: in response to a service call initiated by the second service program instance for the first service program instance based on the first calling address of the first service program instance maintained, obtaining a data authorization request for user data maintained by the first data collaborator carried in the calling parameters corresponding to the service call.
  • the first data collaborator configures an authorization approval process for the maintained user data; wherein the approval process includes at least one approver designated by the first data collaborator; the first service program instance in the authorization unit 520 responds to the data authorization request, and authorizes the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator, including: the first service program instance responds to the data authorization request, obtains the authorization approval process configured by the first data collaborator for the target user data, and triggers the execution of the authorization approval process, and in response to the approval of each approver included in the authorization approval process, generates an authorization credential for the second data collaborator to authorize the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator.
  • the authorization unit 520 returns the authorization result to the second service program instance through the data synchronization channel, including: based on the maintained second calling address of the second service program instance, initiating a service call for the second service program instance, and synchronizing the authorization credential as a calling parameter to the second service program instance.
  • the authorization unit 520 when returning the authorization result to the second service program instance through the data synchronization channel, also includes: publishing the authorization certificate to the data security blockchain for evidence storage; the authorization unit 520 synchronizes the authorization certificate to the second service program instance, including: synchronizing the evidence identifier of the authorization certificate on the data security blockchain as a calling parameter to the second service program instance, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the evidence identifier.
  • the authorization unit 520 before synchronizing the authorization credential to the second service program instance, also includes: generating an authorization record for the cross-domain transfer authority of the encrypted data of the target user data, and publishing the generated authorization record to the data security blockchain for evidence storage.
  • the first data collaborator configures data usage rules for the maintained user data; wherein the data usage rules define restriction rules for the use of the user data; the device also includes: a computing unit, in response to a triggered transfer task of transferring the ciphertext data of the target user data across domains to the second data collaborator, generates a usage program for using the target user data based on the data usage rules, and transfers the usage program and the ciphertext data of the target user data to the second service program instance through the data synchronization channel, so that the usage program is run by the second service program instance, and ciphertext calculations are performed on the ciphertext data of the target user data based on the data usage rules contained in the usage program.
  • the computing unit transfers the encrypted data of the usage program and the target user data to the second service program instance through the data synchronization channel, including: initiating a service call for the second service program instance based on a maintained second calling address of the second service program instance, and transferring the encrypted data of the usage program and the target user data to the second service program instance as calling parameters.
  • a storage sub-unit which generates a cross-domain transfer record corresponding to the ciphertext data of the target user data, and publishes the generated cross-domain transfer record to the data security blockchain for storage.
  • the data usage rules include any one or more combinations of the following: usage mode restriction rules; wherein the usage mode restriction rules define the types of operations that are restricted when operating on the ciphertext data of the target user data; usage count restriction rules; wherein the usage count restriction rules define the number of uses that are restricted when operating on the ciphertext data of the target user data; desensitization restriction rules; wherein the desensitization restriction rules define the desensitization strategy for the plaintext content corresponding to the ciphertext result obtained by ciphertext calculation on the ciphertext data of the target user data.
  • the application includes an SDK package.
  • the device also includes: a receiving subunit, the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel; wherein the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the authorization credential; a decryption subunit, the first service program instance responds to the decryption request, verifies the authorization credential, and in response to the verification of the authorization credential passing, decrypts the ciphertext calculation result to obtain a plaintext calculation result, and based on the desensitization policy defined in the desensitization restriction rules included in the data usage rules, desensitizes the plaintext calculation result, and synchronizes the desensitized plaintext calculation result to the second service program instance through the data synchronization channel.
  • the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the
  • the receiving sub-unit includes: in response to the second service program instance initiating a service call for the first service program instance based on the first calling address of the first service program instance maintained, obtaining a decryption request carried in a calling parameter corresponding to the service call; synchronizing the desensitized plaintext calculation result to the second service program instance through the data synchronization channel, including: based on the maintained second calling address of the second service program instance, initiating a service call for the second service program instance, and synchronizing the desensitized plaintext calculation result as a calling parameter to the second service program instance.
  • the blockchain collaboration platform includes a blockchain cloud service platform; and the service devices corresponding to the respective data collaboration parties include virtual service devices created for the respective data collaboration parties on the cloud service platform.
  • a typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.
  • the relevant parts can refer to the partial description of the method embodiments.
  • the device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.
  • the multi-instance networking device based on blockchain described in FIG12 and the internal functional modules and structural diagram of the cross-domain data authorization described in FIG13 may actually be executed by an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute any of the above-mentioned embodiments of the multi-instance networking method based on blockchain.
  • the internal functional modules and structural diagram of the cross-domain data authorization described in Figure 13 above, its actual execution subject can be an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute any embodiment of the above-mentioned cross-domain data authorization method.
  • the processor may be a CPU, or other general-purpose processors, digital signal processors (English: Digital Signal Processor, abbreviated: DSP), application-specific integrated circuits (English: Application Specific Integrated Circuit, abbreviated: ASIC), etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
  • the aforementioned memory may be a read-only memory (English: read-only memory, abbreviated: ROM), a random access memory (English: random access memory, abbreviated: RAM), a flash memory, a hard disk or a solid-state hard disk.
  • the steps of the method disclosed in conjunction with the embodiment of the present invention may be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

Les modes de réalisation de la présente invention concernent un procédé et un appareil de mise en réseau multi-instance basée sur une chaîne de blocs, ainsi qu'un dispositif électronique. Le procédé comprend les étapes suivantes : recevoir une demande d'accès initiée par un premier collaborateur de données, la demande d'accès comprenant un identifiant de dispositif d'au moins un dispositif de service correspondant au premier collaborateur de données ; en réponse à la demande d'accès, prendre le ou les dispositifs de service en tant que nœud de chaîne de blocs et les ajouter à une chaîne de blocs de sécurité de données, et créer une première instance de programme de service associée au ou aux dispositifs de service correspondant au premier collaborateur de données ; et déterminer si une seconde instance de programme de service, qui est associée à au moins un dispositif de service correspondant à un second collaborateur de données autre que le premier collaborateur de données parmi une pluralité de collaborateurs de données, est créée, et si tel est le cas, créer un canal de synchronisation de données entre la première instance de programme de service et la seconde instance de programme de service.
PCT/CN2022/135245 2022-10-31 2022-11-30 Procédé et appareil de mise en réseau multi-instance basé sur une chaîne de blocs, et dispositif électronique WO2024092928A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211352499.3 2022-10-31
CN202211352499.3A CN115801344A (zh) 2022-10-31 2022-10-31 基于区块链的多实例组网方法及装置和电子设备

Publications (1)

Publication Number Publication Date
WO2024092928A1 true WO2024092928A1 (fr) 2024-05-10

Family

ID=85434706

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/135245 WO2024092928A1 (fr) 2022-10-31 2022-11-30 Procédé et appareil de mise en réseau multi-instance basé sur une chaîne de blocs, et dispositif électronique

Country Status (2)

Country Link
CN (1) CN115801344A (fr)
WO (1) WO2024092928A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210248605A1 (en) * 2019-01-31 2021-08-12 Advanced New Technologies Co., Ltd. Cross-chain right usage systems, methods, apparatuses, electronic devices, and storage media
CN113986865A (zh) * 2021-08-17 2022-01-28 哈尔滨海邻科信息技术有限公司 一种基于区块链的跨部门业务协同系统及方法
CN114827135A (zh) * 2021-01-12 2022-07-29 腾讯科技（深圳）有限公司 一种跨链协同治理系统、方法、设备及存储介质
CN115766123A (zh) * 2022-10-31 2023-03-07 蚂蚁区块链科技(上海)有限公司 数据跨域授权方法及装置和电子设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210248605A1 (en) * 2019-01-31 2021-08-12 Advanced New Technologies Co., Ltd. Cross-chain right usage systems, methods, apparatuses, electronic devices, and storage media
CN114827135A (zh) * 2021-01-12 2022-07-29 腾讯科技（深圳）有限公司 一种跨链协同治理系统、方法、设备及存储介质
CN113986865A (zh) * 2021-08-17 2022-01-28 哈尔滨海邻科信息技术有限公司 一种基于区块链的跨部门业务协同系统及方法
CN115766123A (zh) * 2022-10-31 2023-03-07 蚂蚁区块链科技(上海)有限公司 数据跨域授权方法及装置和电子设备

Also Published As

Publication number Publication date
CN115801344A (zh) 2023-03-14

Similar Documents

Publication Publication Date Title
US10402578B2 (en) Management of encrypted data storage
US10469460B2 (en) Data sharing in a blockchain-enabled trust domain
US10623272B2 (en) Authenticating connections and program identity in a messaging system
CN113364735B (zh) 多链场景下数据跨链访问控制方法、系统、设备及终端
WO2021115449A1 (fr) Système, procédé et dispositif d'accès inter-domaines, support de stockage et dispositif électronique
WO2018095416A1 (fr) Procédé, dispositif et système de traitement d'informations
WO2016131171A1 (fr) Procédé et dispositif d'exploitation de progiciel de vnf
WO2022193984A1 (fr) Procédé et appareil de transmission de données en chaîne transversale, dispositif informatique, support de stockage et produit-programme informatique
WO2013152565A1 (fr) Procédé et système de présentation et d'agrégation de capacités
WO2023124746A1 (fr) Commande d'autorisation d'interaction inter-sous-réseau
WO2024092929A1 (fr) Procédé et appareil d'autorisation de données inter-domaine, et dispositif électronique
CN112307116A (zh) 基于区块链的数据访问控制方法、装置及设备
CN115328645A (zh) 计算任务调度方法、计算任务调度装置及电子设备
WO2017211161A1 (fr) Procédé et dispositif de gestion de ressources basés sur un réseau défini par logiciel
US10785056B1 (en) Sharing a subnet of a logically isolated network between client accounts of a provider network
CN113271366B (zh) 基于区块链和安全计算的数据共享系统
WO2022037239A1 (fr) Système et procédé de prise en charge de service d'intelligence artificielle dans un réseau
CN105743922B (zh) 域间通信的方法、装置以及系统
WO2024092928A1 (fr) Procédé et appareil de mise en réseau multi-instance basé sur une chaîne de blocs, et dispositif électronique
CN113612732B (zh) 一种资源调用方法、装置和多方安全计算系统
US11283609B2 (en) Method and apparatus for supporting secure data routing
TWI829218B (zh) 可經由第三方服務子系統間接移轉取用訊標的去中心化資料授權控管系統
JP2009031831A (ja) コミュニティ通信ネットワーク、通信制御方法、コミュニティ管理サーバ、コミュニティ管理方法、およびプログラム
CN113590711A (zh) 一种高弹性可扩展的多链数据分级共享存储系统及方法
Toth Design of a social messaging system using stateful multicast

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22964224

Country of ref document: EP

Kind code of ref document: A1