WO2024092929A1 - 数据跨域授权方法及装置和电子设备 - Google Patents

数据跨域授权方法及装置和电子设备 Download PDF

Info

Publication number
WO2024092929A1
WO2024092929A1 PCT/CN2022/135265 CN2022135265W WO2024092929A1 WO 2024092929 A1 WO2024092929 A1 WO 2024092929A1 CN 2022135265 W CN2022135265 W CN 2022135265W WO 2024092929 A1 WO2024092929 A1 WO 2024092929A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
service program
program instance
service
authorization
Prior art date
Application number
PCT/CN2022/135265
Other languages
English (en)
French (fr)
Inventor
于源
孙善禄
王天雨
方唯振
Original Assignee
蚂蚁区块链科技(上海)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 蚂蚁区块链科技(上海)有限公司 filed Critical 蚂蚁区块链科技(上海)有限公司
Publication of WO2024092929A1 publication Critical patent/WO2024092929A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of this specification relate to the field of blockchain technology, and in particular to a method and device for cross-domain data authorization and an electronic device.
  • the data security blockchain (abbreviated as Data Security Chain) is a widely used solution based on blockchain technology to ensure the secure transfer of user data.
  • Data Security Chain is a widely used solution based on blockchain technology to ensure the secure transfer of user data.
  • user data can be transferred across domains in the form of ciphertext between multiple cross-domain data collaboration parties (data sources), but the control of user data is not transferred.
  • the embodiments of this specification provide a method and device for cross-domain data authorization and an electronic device.
  • a data cross-domain authorization method is provided, the method being applied to a data collaboration platform based on a data security blockchain;
  • a blockchain node in the data security blockchain includes service devices corresponding to a plurality of data collaboration parties respectively; a first service program instance associated with at least one service device corresponding to a first data collaboration party among the plurality of data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the plurality of data collaboration parties is created;
  • the service program instance is used to perform authorization management on the cross-domain transfer of ciphertext data of user data stored on the service device associated therewith;
  • the data collaboration platform creates a data Synchronization channel; the multiple data collaborators correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance;
  • the method comprises: the first service program instance receives a data authorization request initiated by the second data
  • a data cross-domain authorization device is provided, and the device is applied to a data collaboration platform based on a data security blockchain;
  • the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively; a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties;
  • the service program instance is used to perform authorization management on the cross-domain transfer of ciphertext data of user data stored on the service device associated with it;
  • the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance;
  • the multiple data collaborators correspond to different data domains respectively;
  • the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance;
  • the device includes: a receiving unit, the first service program instance receives a data authorization request
  • an electronic device comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured as any one of the above-mentioned cross-domain data authorization methods.
  • the embodiments of the present specification create an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and create a data synchronization channel between the service program instances created for each data collaboration party, so that each data collaboration party connected to the data collaboration platform can synchronize data with other data collaboration parties in real time based on the data synchronization channel when there is a need to transfer the encrypted data of the maintained user data to other data collaboration parties across domains.
  • FIG. 1 is a diagram of a network service architecture using multi-instance networking in a data collaboration platform provided in an embodiment of the present specification.
  • FIG2 is a flowchart of a multi-instance networking method based on blockchain provided in an embodiment of this specification.
  • FIG. 3 is a schematic diagram of a device registration process in a service program example provided in an embodiment of this specification.
  • FIG. 4 is a schematic diagram of a device update process in a service program example provided in an embodiment of this specification.
  • FIG. 5 is a schematic diagram of a data registration process in a service program example provided in an embodiment of this specification.
  • FIG. 6 is a schematic diagram of a data update process in a service program example provided in an embodiment of this specification.
  • FIG. 7 is a schematic diagram of a data downlink process in a service program example provided in an embodiment of the present specification.
  • FIG8 is a flow chart of a method for cross-domain data authorization provided in an embodiment of the present specification.
  • FIG. 9 is a schematic diagram of cross-domain data authorization provided in an embodiment of this specification.
  • FIG. 10 is a schematic diagram of cross-domain data transfer provided in an embodiment of this specification.
  • FIG11 is a hardware structure diagram of a multi-instance networking or data cross-domain authorization device based on blockchain provided in an embodiment of this specification.
  • FIG12 is a module of a multi-instance networking device based on blockchain provided in an embodiment of this specification.
  • FIG. 13 is a module of a data cross-domain authorization device provided in an embodiment of this specification.
  • first, second, third, etc. may be used in this specification to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • word “if” as used herein may be interpreted as "at the time of” or "when” or "in response to determining”.
  • Data security blockchain (abbreviated as data security chain) is a network service architecture that uses blockchain as the underlying service.
  • the blockchain nodes on the blockchain as the underlying service can usually include service devices corresponding to multiple data collaboration parties.
  • the multiple data collaboration parties usually correspond to different data domains respectively. It should be noted that the multiple data collaboration parties correspond to different data domains respectively, which specifically means that the service devices corresponding to the multiple data collaboration parties need to carry out cross-domain data transmission and communication.
  • different service devices can usually access the user data stored in the local database of other service devices through the domain name access address (i.e., URL address).
  • URL address domain name access address
  • a service device accesses another service device through the URL address, if the URL address of the accessed service device is different from the URL address of the service device that initiated the access, then the data transmission and communication between the two service devices is called cross-domain.
  • the multiple service devices can share the same domain name access address.
  • the user data maintained by each data collaborator is usually stored in the local database of the service device corresponding to each data collaborator.
  • the blockchain can only store the data attribute information (also called data directory) corresponding to the user data maintained by each data collaborator.
  • any data collaborator can find the user data published by other data collaborators who have joined the data security blockchain by obtaining the data attribute information on the blockchain.
  • the data collaborator finds the user data of interest published by other data collaborators, it can also initiate a data authorization application to the other data collaborator, and the owner of the user data requesting authorization will conduct the authorization approval.
  • the encrypted data of the user data can be transferred across domains to the data collaborator through the data synchronization channel between the data collaborators.
  • the solution based on the existing data security blockchain can ensure that the control of user data is not transferred while transferring user data across domains in the form of ciphertext.
  • the existing data collaboration platform based on the data security blockchain usually adopts a centralized network service architecture based on a single service program instance.
  • the data collaboration platform can utilize the resources on the blockchain service platform to jointly create a centralized service program instance for the multiple data collaborators on the data collaboration platform, and authorize the cross-domain transfer of ciphertext data of user data maintained by the multiple data collaborators through the centralized service program instance.
  • the service program instance can be a software service unit created on the blockchain service platform using resources on the blockchain service platform to provide services to the multiple data collaborators.
  • the centralized service program instance can be associated with all service devices that have joined the data security blockchain as blockchain nodes, and authorize the cross-chain transfer of encrypted data of user data stored in the local databases of all service devices associated with it.
  • any data protocol party among the above-mentioned multiple data collaborators upon discovering user data of interest published by other data collaborators, can initiate a data authorization application to the centralized service program instance, and the service program instance will perform authorization and approval.
  • this specification proposes a distributed network service architecture that uses multiple service program instances for networking on a data collaboration platform based on a data security blockchain.
  • a centralized network service architecture based on a single service program instance may no longer be used.
  • the resources on the data collaboration platform can be used to create a service program instance associated with at least one service device corresponding to each data collaboration party, and create a data synchronization channel between the service program instances corresponding to each data collaboration party, and synchronize data between the data collaboration parties through the data synchronization channel.
  • the data collaboration platform since the above-mentioned data collaboration party platform no longer adopts a centralized network service architecture based on a single service program instance, but adopts a network service architecture based on networking of multiple service program instances, the data collaboration platform will create an independent service program instance for each data collaboration party connected to the data collaboration platform, and create a data synchronization channel between the service program instances created for each data collaboration party, so that each data collaboration party connected to the data collaboration platform, when there is a need to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, can synchronize data with other data collaboration parties in real time based on the data synchronization channel, thereby meeting the data synchronization needs in the data collaboration alliance formed based on the data collaboration relationship.
  • each data collaborator can only discover data sets published by other data collaborators by periodically obtaining data attribute information corresponding to data sets published by other data collaborators from the data security chain.
  • This method obviously has a lag.
  • data collaborators who are data users they cannot perceive the latest data published by other data collaborators in the first place; similarly, for data collaborators who are data providers, they cannot promptly notify other data collaborators of the latest data they have published.
  • the network service architecture based on multiple service program instances in the above technical solution is adopted, since an independent service program instance is created for each data collaborator on the data collaboration platform, and a data synchronization channel is opened between the service instances corresponding to each data collaborator. Therefore, after the data collaborator as the data provider publishes the latest data on the data security blockchain, the evidence identification of the published data on the data security blockchain can be synchronized to the corresponding service program instances of other data collaborators in a timely manner through the data synchronization channel.
  • FIG. 1 is a diagram of a network service architecture using multi-instance networking in a data collaboration platform as shown in this specification.
  • the data collaboration platform may no longer adopt a centralized network service architecture based on a single service program instance, but may adopt a distributed network service architecture in which multiple service program instances are networked.
  • the first service program instance shown in Figure 1 can be a service program instance created by the above-mentioned data collaboration platform for a first data collaboration party accessing the data collaboration platform, and associated with a service device corresponding to the first data collaboration party.
  • the second service program instance shown in Figure 1 can be a service program instance created by the above-mentioned data collaboration platform for a second data collaboration party accessing the data collaboration platform, and associated with a service device corresponding to the second data collaboration party.
  • each data collaboration party connected to the data collaboration platform can correspond to one service device or multiple service devices.
  • the service device corresponding to the data collaboration party will be added to the digital security blockchain as a blockchain node; for example, as shown in Figure 1, the service devices corresponding to the first data collaboration party include multiple devices, namely service devices 1 to service devices 4; the service device corresponding to the second data collaboration platform includes one device, namely service device 5.
  • the above service program instance may specifically adopt a three-layer service architecture as shown in FIG. 1 , which includes a first service layer, a second service layer and a third service layer.
  • the first service layer may be an application service layer corresponding to the digital security blockchain.
  • the second service layer may be an authorization service layer corresponding to the digital security blockchain.
  • the third service layer can be the basic service layer corresponding to the digital security blockchain.
  • service layer among the above three service layers, it can include some basic service components provided on the data collaboration platform.
  • the above three service layers may include service components such as SLB (Server Load Balancer) and ECS (Elastic Compute Service).
  • SLB Server Load Balancer
  • ECS Elastic Compute Service
  • the above-mentioned application service layer may specifically include a cross-domain transfer component for realizing the function of cross-domain transfer of ciphertext data, an encryption and decryption component for realizing the encryption and decryption functions for ciphertext data, and the like.
  • the cross-domain transfer component and the encryption and decryption component may both be cloud components implemented based on cloud computing resources related to the ECS service on the cloud service platform.
  • the above-mentioned authorization service layer may specifically include a dataAuth (data authorization) component for implementing authorization management for cross-domain transfer of encrypted data, a DIS (Decentralized Identity Service) component for implementing management of blockchain digital identities for user data on the digital security blockchain, and a transit service component for implementing data transfer for data stored on the digital security blockchain and obtaining data from the digital security blockchain at a regular interval, etc.
  • a dataAuth data authorization
  • DIS Decentralized Identity Service
  • transit service component for implementing data transfer for data stored on the digital security blockchain and obtaining data from the digital security blockchain at a regular interval, etc.
  • the data collaboration platform is a cloud service platform
  • the dataAuth, DIS components and the transit service may all be cloud components implemented based on cloud computing resources related to the ECS service on the cloud service platform.
  • the above-mentioned basic service layer can be used to implement basic service functions related to digital security blockchain; for example, service functions such as data on-chain storage.
  • each blockchain node on the data security blockchain i.e., the service device corresponding to each data collaboration party
  • can be a virtual service device such as a virtual machine created based on the cloud computing resources related to the ECS service on the cloud service platform.
  • the application service layer and the authorization service layer may include several databases in addition to several service components.
  • the database types of the databases included in the application service layer and the authorization service layer are not specifically limited in this specification.
  • the database types may include MySQL, Redis, OSS, SqlLite, etc.
  • the database on the above application service layer can be used as a local database on the service device corresponding to the data collaboration party, and can be used to store user data that needs to be transferred across domains.
  • the database on the above authorization service layer can include databases corresponding to each service component on the authorization service layer; for example, as shown in Figure 1, the authorization service layer can include a database corresponding to the dataAuth component and the DIS component, and can also include a database corresponding to the transit service component.
  • the database corresponding to the dataAuth component and the DIS component can be used to store data related to data authorization for cross-domain transfer of user data.
  • the database corresponding to the transit service component can be used to store data that the component obtains from the digital security blockchain on a regular basis.
  • a data synchronization channel may be created between the first service program instance and the second service program instance for real-time data synchronization between the service program instances.
  • the data synchronization channel may be a service call channel created between the service program instances based on the call address of the service program instance (such as the domain name access address of the service device associated with the service program instance).
  • the multiple service layers shown in Figure 1 can be merged into one service layer, or a service layer shown in Figure 1 can be further split into multiple service layers, or the multiple components shown in Figure 1 can be merged into one component according to their functions, or a component shown in Figure 1 can be further divided and split into multiple components according to its functions, and so on. Examples will not be given one by one in this specification.
  • the second data collaboration party shown in FIG1 when the second data collaboration party shown in FIG1 does not allow the ciphertext data of the user data stored on the service device corresponding to the second data collaboration party to be transferred across domains to other data collaboration parties, the second data collaboration party can only serve as a data user, but not as a data provider.
  • the dataAuth component and the DIS component shown in FIG1 may not be included in the above-mentioned second service program instance corresponding to the second data collaboration party.
  • Figure 2 is a flowchart of a multi-instance networking method based on blockchain shown in this specification according to an exemplary embodiment.
  • the method can be applied to a data collaboration platform based on a data security blockchain that adopts the network service architecture shown in Figure 1; the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively; the user data maintained by each data collaboration party is respectively stored in the local database of the service device corresponding to each data collaboration party; the data attribute information corresponding to the user data maintained by each data collaboration party is stored on the data security blockchain; the method includes steps 210 to 240.
  • Step 210 Receive an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party.
  • the above-mentioned data collaboration platform can be a cloud service platform; for example, in one example, the above-mentioned data collaboration platform can be a blockchain cloud service platform.
  • the above-mentioned blockchain cloud service platform can be a BaaS platform (also referred to as BaaS cloud) for providing blockchain as a service (BaaS, Blockchain as a Service).
  • BaaS platform can provide easy-to-use, one-click deployment, fast verification, and flexible and customizable blockchain services for service devices coupled to the BaaS platform by providing pre-written software for activities occurring on the blockchain, thereby accelerating the development, testing, and launch of blockchain business applications, and helping the implementation of blockchain business application scenarios in various industries.
  • the above-mentioned service device can be a local service device deployed by the data collaborator, or it can be a virtual service device created for the data collaborator by using cloud computing resources on a cloud service platform.
  • the service device corresponding to the data collaborator can be a VM virtual machine created for the data collaborator by the cloud service platform, which is created by the cloud service platform using cloud computing resources such as computing resources, storage resources, and transmission resources on the cloud service platform.
  • the first data collaboration party When the first data collaboration party wants to transfer the encrypted data of user data across domains to other data collaboration parties, or wants to obtain the encrypted data of user data maintained by other data collaboration parties that have been connected to the above-mentioned data collaboration platform across domains, it can specifically initiate an access request to the data collaboration platform; wherein, the access request can specifically include the device identifier of at least one service device corresponding to the first data collaboration party.
  • Step 220 In response to the access request, the at least one service device is added to the data security blockchain as a blockchain node, and a first service program instance associated with the at least one service device corresponding to the first data collaboration party is created.
  • the data collaboration platform can respond to the access request and add at least one service device corresponding to at least one device identifier included in the access request as a blockchain node to the digital security blockchain network.
  • the blockchain collaboration platform can also use the resources on the data collaboration platform to create a first service program instance on the data collaboration platform that is associated with at least one service device corresponding to the first data collaboration party.
  • Step 230 determining whether a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties except the first data collaboration party is created.
  • the data collaboration platform can further determine whether to create a second service program instance associated with at least one service device corresponding to the second data collaboration party for the second data collaboration party connected to the data collaboration platform in the same manner.
  • Step 240 if yes, create a data synchronization channel between the first service program instance and the second service program instance; wherein the multiple data collaborators correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used to perform authorization management on the cross-chain transfer of encrypted data corresponding to user data stored on the service device associated with it.
  • the data collaboration platform determines that a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties has been created, the data collaboration platform can further create a data synchronization channel between the first service program instance and the second service program instance.
  • the data synchronization channel can be specifically used for cross-domain data synchronization between the first service program instance and the second service program instance.
  • the networking between the first data collaboration party and the second data collaboration party is completed. Subsequently, the first service program instance and the second service program instance can perform real-time cross-domain data synchronization based on the data synchronization channel.
  • the second data collaborator here may refer to other data collaborators other than the first data collaborator, and the other data collaborators may be one or more.
  • the second service program instance may also refer to other service program instances created by the data collaboration platform for other data collaborators other than the first data collaborator, and the other service program instances may be one or more.
  • the data collaboration platform can respectively create data synchronization channels between the first service program instance and multiple service program instances created for the multiple other data collaboration parties to complete the networking between the first data collaboration party and the above-mentioned multiple other data collaboration parties.
  • the data collaboration platform creates service program instances for each connected data collaboration party, and roles may also be divided according to the main service program instance and the slave service program instance.
  • a data collaboration alliance is initiated by the operator of the data security blockchain.
  • the operator can serve as the first data collaborator of the data collaboration alliance.
  • the service program instance created for the operator and associated with at least one service device of the operator can serve as the main service program instance in the data collaboration alliance, and the service program instances created for other data collaborators (such as institutions) that subsequently join the data collaboration alliance can serve as slave service program instances in the data collaboration alliance.
  • the data collaboration platform is a data synchronization channel between service program instances created with each data collaboration party, and specifically may be a service call channel created between service program instances based on a call address of the service program instance.
  • the type of the above-mentioned calling address is not particularly limited in this specification.
  • a domain name access address (ie, URL address) shared by at least one service device corresponding to each service program instance may be used as the calling address corresponding to each service program instance.
  • the service calling channel between each service program instance may be an http calling channel constructed between each service program instance based on a domain name access address shared by at least one service device corresponding to each service program instance.
  • the above-mentioned calling address may be in other forms such as an interface calling address, and the service calling channel between various service program instances may be an interface calling channel, which will not be listed one by one in this specification.
  • the service calling channel between the first service program instance and the second service program can usually include a first service calling channel formed based on the calling address of the second service program instance maintained by the first service program instance, with the first service program instance as the calling initiator and the second service program instance as the called party; and a second service calling channel formed based on the calling address of the first service program instance maintained by the second service program instance, with the second service program instance as the calling initiator and the first service program instance as the called party.
  • the dataAuth component located in the authorization service layer is functionally distinguished and is usually a core component in a service program instance; therefore, in this case, when creating a data synchronization channel between a first service program instance and a second service program instance, the url address of the second service program instance can be specifically added to the dataAuth component of the first service program instance for maintenance, so as to form a first http call channel between the dataAuth component of the first service program instance and the second service program instance.
  • the url address of the first service program instance can be added to the dataAuth component of the second service program instance for maintenance, so as to form a second http call channel between the dataAuth component of the second service program instance and the first service program instance, so as to complete the creation of the data synchronization channel between the first service program instance and the second service program instance.
  • real-time data synchronization can be performed between the first service program instance and the second service program instance based on the data synchronization channel.
  • the following describes in detail the data synchronization process between the first service program instance and the second service program instance in conjunction with a specific data synchronization scenario.
  • the first data collaborator when the first data collaborator needs to add a new service device, the first data collaborator can initiate device registration to the first service program instance, associate the newly added service device with the first service program instance, and after the association is completed, the first service program instance synchronizes the device information of the newly added service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the device information of the service device newly added in the first service program instance.
  • the first service program instance receives a device registration request; wherein the device registration request includes the device information of the service device newly added by the first data collaboration party; in response to the device registration request, the first service program instance establishes an association relationship between the newly added service device and the first service program instance, and stores the device information of the newly added service device and the association relationship in a database corresponding to the first service program instance; then, further calling the DataAuth component in the first service program instance, and the DataAuth component further calls the DIS component in the first service program instance, and the DIS component creates digital identity information for the newly added service device on the data security blockchain, and returns the created digital identity information to the DataAuth component.
  • the DataAuth component further initiates a service call for the first service program instance (i.e., the callback call in Figure 3) based on the maintained calling address of the first service program instance, so as to return the digital identity information of the newly added service device to the first service program instance, and store it in the database corresponding to the first service program instance, that is, store the digital identity information.
  • a service call for the first service program instance i.e., the callback call in Figure 3
  • the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the digital identity information and device information of the newly added service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, and synchronize and store them in the database corresponding to the second service program instance, that is, store the digital identity information and device information.
  • the DIS component creates digital identity information for the newly added service device on the data security blockchain, which may include: the DIS component calls the smart contract deployed on the data security blockchain to create digital identity information for the newly added service device on the data security blockchain.
  • the first data collaborator when the first data collaborator needs to update any target service device associated with the first service program instance, the first data collaborator can initiate a blockchain device update to the first service program instance, update the device information of the target service device in the database corresponding to the first service program instance, and synchronize the updated device information of the target service device to the second service program instance through the data synchronization channel between the first data collaborator and the second service program instance.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the updated device information of the target service device in the first service program instance.
  • the first service program instance receives a blockchain device update request; wherein the blockchain device update request includes the device information to be updated of any target service device associated with the first service program instance; in response to the blockchain device update request, the first service program instance updates the device information of the target service device stored in the database corresponding to the first service program instance based on the device information to be updated; then, further calling the DataAuth component in the first service program instance, and the DataAuth component further calls the DIS component in the first service program instance, and the DIS component updates the digital identity information of the target service device on the data security blockchain, and returns the updated digital identity information to the DataAuth component.
  • the DataAuth component further initiates a service call to the first service program instance based on the maintained calling address of the first service program instance, so as to return the updated digital identity information to the first service program instance, and store the updated digital identity information of the target service device in the database corresponding to the first service program instance.
  • the DataAuth component can also initiate a service call to the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the updated device information and updated digital identity information of the target service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, and synchronously update the device information of the target service device stored in the database corresponding to the second service program instance, that is, store the updated device information and updated digital identity information of the target service device.
  • the DIS component updates the digital identity information of the target service device on the data security blockchain, which may include: the DIS component calls the smart contract deployed on the data security blockchain to create new digital identity information for the target service device on the data security blockchain, and associates the new digital identity information with the old digital identity information of the target service device.
  • the created new digital identity information is the updated digital identity information of the target service device.
  • the first data collaborator when the first data collaborator needs to publish a data set consisting of user data stored in a local database, the first data collaborator can initiate data registration to the first service program instance, generate data attribute information corresponding to the data set, and after storing the data attribute information in the data security blockchain (the blockchain storage identifier corresponding to the data attribute information can be obtained), the first service program instance synchronizes the blockchain storage identifier to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain storage identifier.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the blockchain evidence identifier corresponding to the data attribute information.
  • the first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes the data set requested to be registered by the target service device; in response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information in the local database of the target service device; then, the DataAuth component in the first service program instance is further called, and the DataAuth component publishes the data attribute information corresponding to the data set to the data security blockchain for storage, so as to obtain a blockchain storage identifier for querying the data attribute information on the chain from the data security blockchain.
  • the DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the blockchain evidence identifier and the data attribute information to the first service program instance, and store them in a database corresponding to the first service program instance, i.e., the blockchain evidence identifier and the data attribute information are stored in association with each other.
  • the first service program instance calls the DataAuth component in the first service program instance
  • the DataAuth component calls the DIS component in the first service program instance
  • the DIS component further creates digital identity information including the corresponding blockchain evidence identifier for the data attribute information corresponding to the data set on the data security blockchain, and returns the created digital identity information to the DataAuth component.
  • the DIS component can create digital identity information including the blockchain evidence identifier on the data security blockchain for the data attribute information by calling the smart contract deployed on the data security blockchain.
  • the DataAuth component initiates a service call to the first service program instance based on the maintained calling address of the first service program instance, so as to return the digital identity information of the data attribute information to the first service program instance, and store it in the database corresponding to the first service program instance, that is, to store the digital identity information of the data attribute information.
  • the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the digital identity information of the data attribute information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance; so that the second service program instance can obtain the data attribute information from the data security blockchain based on the blockchain evidence identifier contained in the digital identity information, and synchronously store the obtained data attribute information in the database corresponding to the second service program instance.
  • the first data collaborator when the first data collaborator needs to update a published data set, the first data collaborator can initiate a data update to the first service program instance, generate updated data attribute information corresponding to the updated data set, and after storing the updated data attribute information on the data security blockchain (the blockchain storage identifier corresponding to the updated data attribute information can be obtained), the first service program instance synchronizes the blockchain storage identifier corresponding to the updated data attribute information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain storage identifier.
  • the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the blockchain evidence identifier corresponding to the updated data attribute information.
  • the first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes the data set requested to be updated by the target service device; in response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in the local database of the target service device; then, the DataAuth component in the first service program instance is further called, and the DataAuth component publishes the updated data attribute information corresponding to the data set to the data security blockchain for storage, so as to obtain a blockchain storage identifier for querying the updated data attribute information from the data security blockchain.
  • the DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the blockchain evidence identifier and the updated data attribute information to the first service program instance, and store them in a database corresponding to the first service program instance, i.e., the blockchain evidence identifier and the updated data attribute information are stored in association with each other.
  • the first service program instance calls the DataAuth component in the first service program instance
  • the DataAuth component calls the DIS component in the first service program instance
  • the DIS component further updates the data identity information of the updated data attribute information corresponding to the data set on the data security blockchain, and returns the updated digital identity information to the DataAuth component.
  • the DIS component can call the smart contract deployed on the data security blockchain to create new digital identity information on the data security blockchain for the updated data attribute information, and associate the new digital identity information with the old digital identity information of the data attribute information before the update.
  • the new digital identity information created is the updated digital identity information of the data set.
  • the DataAuth component initiates a service call to the first service program instance based on the maintained calling address of the first service program instance, so as to return the updated digital identity information to the first service program instance, and store it in the database corresponding to the first service program instance, that is, to store the updated digital identity information.
  • the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the updated digital identity information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance; so that the second service program instance can obtain the updated data attribute information from the data security blockchain based on the blockchain evidence identifier contained in the updated digital identity information, and synchronously update the obtained updated data attribute information in the database corresponding to the second service program instance.
  • the first data collaborator when the first data collaborator needs to delete the published target data set, the first data collaborator can initiate a data downlink to the first service program instance, delete the target data set and the data attribute information of the target data set stored in the local database, and the first service program instance synchronizes the deletion notification of the target data set to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance synchronously deletes the target data set.
  • the data attribute information of the target data set is synchronized between the first service program instance and the second service program instance through the data synchronization channel.
  • the first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes the data set identifier of the target data set requested to be deleted by the target service device; in response to the data deletion request, the first service program instance deletes the target data set and the data attribute information of the target data set stored in the local database of the target service device; then, the DataAuth component in the first service program instance is further called, and the DataAuth component sets the data identity information created by the data attribute information of the data set to an invalid state on the data security chain to obtain the setting result.
  • the DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the setting result to the first service program instance, and switch the state of the data set and data attribute information to a third state in the database corresponding to the first service program instance.
  • the DataAuth component can also initiate a service call to the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the deletion notification of the target data set to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance based on the deletion notification for deletion processing, and set the data identity information maintained in the database to an invalid state.
  • the blockchain-based multi-instance networking embodiment creates an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and creates a data synchronization channel between the service program instances created for each data collaboration party.
  • each data collaboration party connected to the data collaboration platform needs to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, it can synchronize data with other data collaboration parties in real time based on the data synchronization channel.
  • Figure 8 is a flowchart of a cross-domain data authorization method shown in this specification according to an exemplary embodiment.
  • the method can be applied to a data collaboration platform based on a data security blockchain that adopts the network service architecture shown in Figure 1;
  • the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively;
  • a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties is created;
  • the service program instance is used to authorize the cross-domain transfer of encrypted data of user data stored on the service device associated with it;
  • the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance;
  • the multiple data collaboration parties correspond to different data domains respectively;
  • the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the
  • Step 310 The first service program instance receives a data authorization request initiated by the second data collaborator through the data synchronization channel for user data maintained by the first data collaborator; wherein the data authorization request includes the data identifier of the target user data for which the second data collaborator requests authorization.
  • This specification creates a data synchronization channel between service program instances created by each data collaborator, so that each data collaborator connected to the data collaboration platform can perform cross-domain data authorization with other data collaborators in real time based on the data synchronization channel when there is a need for data authorization for cross-domain transfer of encrypted data of user data.
  • the blockchain collaboration platform includes a blockchain cloud service platform; and the service devices corresponding to the respective data collaboration parties include virtual service devices created for the respective data collaboration parties on the cloud service platform.
  • the data collaboration platform is a data synchronization channel between service program instances created with various data collaboration parties, for example, it may be a service calling channel created between service program instances based on a calling address of the service program instance.
  • the type of the above-mentioned calling address is not particularly limited in this specification.
  • a domain name access address (ie, URL address) shared by at least one service device corresponding to each service program instance may be used as the calling address corresponding to each service program instance.
  • the service calling channel between each service program instance may be an http calling channel constructed between each service program instance based on a domain name access address shared by at least one service device corresponding to each service program instance.
  • the above-mentioned calling address may be in other forms such as an interface calling address, and the service calling channel between various service program instances may be an interface calling channel, which will not be listed one by one in this specification.
  • the step 310 may include: in response to a service call initiated by the second service program instance for the first service program instance based on the first calling address of the first service program instance maintained, obtaining a data authorization request for user data maintained by the first data collaborator carried in the calling parameters corresponding to the service call.
  • the service calling channel between the first service program instance and the second service program can usually include a first service calling channel formed based on the calling address of the second service program instance maintained by the first service program instance, with the first service program instance as the calling initiator and the second service program instance as the called party; and a second service calling channel formed based on the calling address of the first service program instance maintained by the second service program instance, with the second service program instance as the calling initiator and the first service program instance as the called party.
  • the second data collaborator When the second data collaborator has a data authorization requirement for the cross-domain transfer of encrypted data of user data published by the first data collaborator, it can initiate a data authorization request for the user data maintained by the first data collaborator to the first service program instance corresponding to the first data collaborator through the data synchronization channel; wherein the data authorization request includes the data identifier of the target user data for which the second data collaborator requests authorization.
  • Step 320 The first service program instance responds to the data authorization request, authorizes the cross-domain transfer authority of the encrypted data of the target user data to the second data collaborator, and returns the authorization result to the second service program instance through the data synchronization channel.
  • the DataAuth component in the first service program instance is called in response to the data authorization request, and the DataAuth component authorizes the cross-domain transfer authority of the encrypted data of the target user data to the second data collaboration party, and returns the authorization result (such as the authorization certificate in Figure 9) to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.
  • the first data collaboration party configures an authorization approval process for the maintained user data; wherein the approval process includes at least one approver designated by the first data collaboration party.
  • the first service program instance responds to the data authorization request and authorizes the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator, including: the first service program instance responds to the data authorization request, obtains the authorization approval process configured by the first data collaborator for the target user data, and triggers the execution of the authorization approval process, and in response to the approval of each approver included in the authorization approval process, generates an authorization credential for the second data collaborator to authorize the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator.
  • each approver can generate five approval statuses: pending approval, approved, rejected, revoked, and approval-free; among them, revocation can be initiated by the applicant of the authorization approval process (such as the second data collaboration party) at any time before the end of the authorization approval process.
  • the revoked authorization approval process is terminated immediately, and the approval result is revoked approval.
  • the authorization approval process if the status of the authorization approval process obtained by the current approver is pending approval, the authorization approval process will be suspended and it will be necessary to wait for the current approver to upload the approval result (one of approval, rejection, and exemption) before continuing to execute; if the uploaded result is rejection, the authorization approval process will be terminated immediately, and the approval result of rejection will be notified to the applicant. If the uploaded result is approval or exemption, determine whether there is the next approver according to the order of the authorization approval process. If there is, the next approver will become the new current approver and switch to the pending approval status; if not, the authorization approval process will be terminated, and the approval result is that all approvers have approved.
  • the first data collaborator can specify the authorization approval process
  • the application approval process may include a default process, a custom process, and an approval-free process, etc.; among them, the default process may refer to the second data collaborator as the approving party to approve first, and then the first data collaborator as the approving party to approve; the custom process may be an approval process customized by the first data collaborator.
  • the first service program instance calls the DataAuth component in the first service program instance, and the DataAuth component performs authorization processing to generate an authorization credential for the second data collaborator to authorize the cross-domain transfer authority of the encrypted data of the target user data to the second data collaborator.
  • returning the authorization result to the second service program instance through the data synchronization channel may include: initiating a service call for the second service program instance based on the maintained second calling address of the second service program instance, and synchronizing the authorization credential to the second service program instance as a calling parameter.
  • synchronizing the authorization credential to the second service program instance before synchronizing the authorization credential to the second service program instance, it also includes: publishing the authorization credential to the data security blockchain for evidence storage; accordingly, synchronizing the authorization credential as a calling parameter to the second service program instance includes: synchronizing the evidence identifier of the authorization credential on the data security blockchain as a calling parameter to the second service program instance, so that the second service program instance obtains the authorization credential from the data security blockchain based on the evidence identifier.
  • the authorization credential can be published to the data security blockchain for storage by calling the DataAuth component; by storing the authorization credential in the data security blockchain, it is ensured that the authorization credential is not tampered with.
  • the synchronization of the authorization certificate to the second service program instance may include: synchronizing the storage identifier of the authorization certificate on the data security blockchain to the second service program instance, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the storage identifier.
  • the authorization credential before synchronizing the authorization credential to the second service program instance, it may also include: generating, by the DataAuth component, an authorization record for the cross-domain transfer authority of the encrypted data of the target user data, and publishing the generated authorization record to the data security blockchain for evidence storage.
  • the first data collaboration party configures data usage rules for the maintained user data; wherein the data usage rules define restriction rules for the use of the user data.
  • the method also includes: in response to a triggered task of transferring the ciphertext data of the target user data across domains to the second data collaboration party, generating a usage program for using the target user data based on the data usage rules, and transferring the usage program and the ciphertext data of the target user data to the second service program instance through the data synchronization channel, so that the usage program is run by the second service program instance, and ciphertext calculation is performed on the ciphertext data of the target user data based on the data usage rules contained in the usage program.
  • transferring the encrypted data of the usage program and the target user data to the second service program instance through the data synchronization channel includes: initiating a service call for the second service program instance based on the maintained second calling address of the second service program instance, and transferring the encrypted data of the usage program and the target user data to the second service program instance as calling parameters.
  • the DataAuth component in the first service program instance monitors the authorization record or cross-domain transfer record for the target user data on the data security chain, the above transfer task can be triggered immediately.
  • the transfer task can be triggered when the DataAuth component in the first service program instance monitors the authorization record stored on the data security chain; it can also be triggered when the DataAuth component monitors the transfer record stored on the chain.
  • the DataAuth component here can generate a cross-domain transfer record corresponding to the ciphertext data of the target user data, and publish the generated cross-domain transfer record to the data security chain for evidence storage.
  • the ciphertext data transfer can be performed after the transfer record is successfully uploaded to the chain, or the ciphertext data transfer can be performed first and then the transfer record can be uploaded to the chain for evidence storage; generally, the former method is relatively safer.
  • the data usage rules may include any one or more combinations of the following: usage mode restriction rules; wherein the usage mode restriction rules define the types of operations that are restricted when operating on the ciphertext data of the target user data; the operation types may include allowed calculation methods and processing methods. For example, allowing identical queries, allowing fuzzy queries, allowing string concatenation, allowing string length, allowing substring truncation, allowing string conversion to lowercase, allowing string conversion to uppercase, etc.
  • the usage limit rule defines the usage limit for the ciphertext data of the target user data when performing operations.
  • Desensitization restriction rules wherein the desensitization restriction rules define a desensitization strategy for the plaintext content corresponding to the ciphertext result obtained by performing ciphertext calculation on the ciphertext data of the target user data.
  • the desensitization strategy may include hash desensitization, shame desensitization, pseudonym desensitization, etc.
  • the application program includes an SDK program package.
  • the SDK package contains some functions related to the above-mentioned data usage rules. These functions restrict the use of the ciphertext data of the target user data. For example, if it is stipulated that only operation A can be performed on the ciphertext data, then the SDK package only contains calculation functions (operators) related to operation A.
  • the method may also include: the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel; wherein the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the authorization credential; the first service program instance responds to the decryption request, verifies the authorization credential, and in response to the verification of the authorization credential passing, decrypts the ciphertext calculation result to obtain a plaintext calculation result, and based on the desensitization policy defined in the desensitization restriction rules contained in the data usage rules, desensitizes the plaintext calculation result, and synchronizes the desensitized plaintext calculation result to the second service program instance through the data synchronization channel.
  • the second service program instance can perform ciphertext calculations of related services on the ciphertext data under the restrictions of the data usage rules specified by the user program.
  • the calculation result obtained is also a ciphertext calculation result; since the calculation result is a ciphertext, the second service program instance also needs to call the DataAuth component in the second service program instance, and the DataAuth component sends the calculation result of the ciphertext and the authorization certificate to the first service program instance through the data synchronization channel; then the DataAuth component in the first service program instance verifies the authorization certificate, and after the verification is passed, the DataAuth component further decrypts the calculation result of the ciphertext, and returns the decrypted plaintext calculation result to the second service program instance through the data synchronization channel.
  • the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel, including: in response to the second service program instance initiating a service call for the first service program instance based on the first calling address of the first service program instance maintained, obtaining the decryption request carried in the calling parameters corresponding to the service call; synchronizing the plaintext calculation result after the desensitization processing to the second service program instance through the data synchronization channel, including: based on the second calling address of the second service program instance maintained, initiating a service call for the second service program instance, and synchronizing the plaintext calculation result after the desensitization processing as a calling parameter to the second service program instance.
  • the data cross-domain authorization implementation example provided in this specification creates an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and creates a data synchronization channel between the service program instances created for each data collaboration party. This allows each data collaboration party connected to the data collaboration platform to synchronize data with other data collaboration parties in real time based on the data synchronization channel when there is a need to transfer the encrypted data of the maintained user data to other data collaboration parties across domains.
  • this specification also provides an embodiment of a multi-instance networking device based on blockchain.
  • the device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer program in the non-volatile memory into the memory and running it. From the hardware level, as shown in Figure 11, it is a hardware structure diagram of the device in which the multi-instance networking device based on blockchain in this specification is located. In addition to the processor, network interface, memory and non-volatile memory shown in Figure 11, the device in the embodiment where the device is located can also include other hardware according to the actual function of data synchronization, which will not be described in detail.
  • Figure 12 is a module diagram of a multi-instance networking device based on blockchain provided in an embodiment of this specification, and the device corresponds to the embodiment shown in Figure 2.
  • the device is applied to a data collaboration platform based on a data security blockchain; the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively; the device includes: a receiving unit 410, receiving an access request initiated by a first data collaboration party; wherein the access request includes the device identification of at least one service device corresponding to the first data collaboration party; a response unit 420, in response to the access request, adding the at least one service device as a blockchain node to the data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaboration party; a determination unit 430, determining whether a service device other than the first data collaboration party among the multiple data collaboration parties has been created.
  • a networking unit 440 when creating a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties except the first data collaboration party, creates a data synchronization channel between the first service program instance and the second service program instance; wherein the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used for cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used for authorizing the cross-chain transfer of ciphertext data corresponding to the user data stored on the service device associated with it.
  • the data synchronization channel includes a service calling channel created between the service program instances based on a calling address of the service program instance.
  • the calling address corresponding to the service program instance includes a domain name access address of a service device associated with the service program instance; and the calling channel includes an http calling channel.
  • the apparatus further includes: a first receiving subunit, wherein the first service program instance receives a device registration request; wherein the device registration request includes device information of a newly added service device of the first data collaboration party; a first responding subunit, wherein in response to the device registration request, the first service program instance establishes an association relationship between the newly added service device and the first service program instance, and stores the device information of the newly added service device and the association relationship in a database corresponding to the first service program instance; and a first synchronization subunit, which initiates a service call for the second service program instance based on a maintained call address corresponding to the second service program instance, synchronizes the device information of the newly added service device to the second service program instance, and synchronizes and stores the information in the database corresponding to the second service program instance.
  • the apparatus further includes: a second receiving subunit, wherein the first service program instance receives a blockchain device update request; wherein the blockchain device update request includes the device information to be updated of any target service device associated with the first service program instance; a second responding subunit, wherein in response to the blockchain device update request, the first service program instance updates the device information of the target service device stored in the database corresponding to the first service program instance based on the device information to be updated; and a second synchronization subunit, which initiates a service call to the second service program instance based on the maintained calling address corresponding to the second service program instance, synchronizes the updated device information of the target service device to the second service program instance, and synchronously updates the device information of the target service device stored in the database corresponding to the second service program instance.
  • the device also includes: a third receiving sub-unit, the first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes a data set requested to be registered by the target service device; a third responding sub-unit, in response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information to a local database of the target service device; and a third synchronization sub-unit, which publishes the data attribute information corresponding to the data set to the data security blockchain for evidence storage, and based on the maintained calling address of the second service program instance, initiates a service call for the second service program instance, synchronizes the blockchain evidence identifier corresponding to the data attribute information to the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain evidence identifier, and synchronizes the obtained data attribute information in the database corresponding to the second service program instance
  • the device also includes: a fourth receiving subunit, the first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes a data set requested to be updated by the target service device; a fourth responding subunit, in response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in the local database of the target service device; and a fourth synchronization subunit, the first service program instance publishes the updated data attribute information corresponding to the data set to the data security blockchain for evidence storage, initiates a service call for the second service program instance based on the maintained calling address of the second service program instance, and synchronizes the blockchain evidence identification of the updated data attribute information to the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain evidence identification, and synchronizes the data attribute information corresponding to the data set stored in the database
  • the device also includes: a fifth receiving sub-unit, the first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes a data set identifier of a target data set that the target service device requests to delete; a fifth responding sub-unit, in response to the data deletion request, the first service program instance deletes the target data set and the data attribute information of the target data set stored in a local database of the target service device; a fifth synchronization sub-unit, based on the maintained calling address of the second service program instance, initiates a service call to the second service program instance to synchronize the deletion notification of the target data set to the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance based on the deletion notification for deletion processing.
  • the data deletion request includes a data set identifier of a target data set that the target service device requests to delete
  • a fifth responding sub-unit in
  • the device also includes: the data collaboration platform includes a blockchain cloud service platform; and the service equipment corresponding to each data collaboration party includes a virtual service equipment created for each data collaboration party on the cloud service platform.
  • Figure 13 is a module diagram of a data cross-domain authorization device provided in an embodiment of this specification, and the device corresponds to the embodiment shown in Figure 8.
  • the device is applied to a data collaboration platform based on a data security blockchain;
  • the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively;
  • a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties;
  • the service program instance is used to perform authorization management on the cross-domain transfer of encrypted data of user data stored on the service device associated with it;
  • the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance; and the multiple data collaboration parties correspond to different Data domain;
  • the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance;
  • the data synchronization channel includes a service calling channel created between the service program instances based on a calling address of the service program instance.
  • the calling address corresponding to the service program instance includes a domain name access address of a service device associated with the service program instance; and the calling channel includes an http calling channel.
  • the receiving unit 510 includes: in response to a service call initiated by the second service program instance for the first service program instance based on the first calling address of the first service program instance maintained, obtaining a data authorization request for user data maintained by the first data collaborator carried in the calling parameters corresponding to the service call.
  • the first data collaborator configures an authorization approval process for the maintained user data; wherein the approval process includes at least one approver designated by the first data collaborator; the first service program instance in the authorization unit 520 responds to the data authorization request, and authorizes the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator, including: the first service program instance responds to the data authorization request, obtains the authorization approval process configured by the first data collaborator for the target user data, and triggers the execution of the authorization approval process, and in response to the approval of each approver included in the authorization approval process, generates an authorization credential for the second data collaborator to authorize the cross-domain transfer permission of the ciphertext data of the target user data to the second data collaborator.
  • the authorization unit 520 returns the authorization result to the second service program instance through the data synchronization channel, including: based on the maintained second calling address of the second service program instance, initiating a service call for the second service program instance, and synchronizing the authorization credential as a calling parameter to the second service program instance.
  • the authorization unit 520 when returning the authorization result to the second service program instance through the data synchronization channel, also includes: publishing the authorization certificate to the data security blockchain for evidence storage; the authorization unit 520 synchronizes the authorization certificate to the second service program instance, including: synchronizing the evidence identifier of the authorization certificate on the data security blockchain as a calling parameter to the second service program instance, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the evidence identifier.
  • the authorization unit 520 before synchronizing the authorization credential to the second service program instance, also includes: generating an authorization record for the cross-domain transfer authority of the encrypted data of the target user data, and publishing the generated authorization record to the data security blockchain for evidence storage.
  • the first data collaborator configures data usage rules for the maintained user data; wherein the data usage rules define restriction rules for the use of the user data; the device also includes: a computing unit, in response to a triggered transfer task of transferring the ciphertext data of the target user data across domains to the second data collaborator, generates a usage program for using the target user data based on the data usage rules, and transfers the usage program and the ciphertext data of the target user data to the second service program instance through the data synchronization channel, so that the usage program is run by the second service program instance, and ciphertext calculations are performed on the ciphertext data of the target user data based on the data usage rules contained in the usage program.
  • the computing unit transfers the encrypted data of the usage program and the target user data to the second service program instance through the data synchronization channel, including: initiating a service call for the second service program instance based on a maintained second calling address of the second service program instance, and transferring the encrypted data of the usage program and the target user data to the second service program instance as calling parameters.
  • a storage sub-unit which generates a cross-domain transfer record corresponding to the ciphertext data of the target user data, and publishes the generated cross-domain transfer record to the data security blockchain for storage.
  • the data usage rules include any one or more combinations of the following: usage mode restriction rules; wherein the usage mode restriction rules define the types of operations that are restricted when operating on the ciphertext data of the target user data; usage count restriction rules; wherein the usage count restriction rules define the number of uses that are restricted when operating on the ciphertext data of the target user data; desensitization restriction rules; wherein the desensitization restriction rules define the desensitization strategy for the plaintext content corresponding to the ciphertext result obtained by ciphertext calculation on the ciphertext data of the target user data.
  • the use program includes an SDK program package.
  • the device also includes: a receiving subunit, the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel; wherein the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the authorization credential; a decryption subunit, the first service program instance responds to the decryption request, verifies the authorization credential, and in response to the verification of the authorization credential passing, decrypts the ciphertext calculation result to obtain a plaintext calculation result, and based on the desensitization policy defined in the desensitization restriction rules included in the data usage rules, desensitizes the plaintext calculation result, and synchronizes the desensitized plaintext calculation result to the second service program instance through the data synchronization channel.
  • the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the
  • the receiving sub-unit includes: in response to the second service program instance initiating a service call for the first service program instance based on the first calling address of the first service program instance maintained, obtaining a decryption request carried in a calling parameter corresponding to the service call; synchronizing the desensitized plaintext calculation result to the second service program instance through the data synchronization channel, including: based on the maintained second calling address of the second service program instance, initiating a service call for the second service program instance, and synchronizing the desensitized plaintext calculation result as a calling parameter to the second service program instance.
  • the blockchain collaboration platform includes a blockchain cloud service platform; and the service device corresponding to each of the data collaboration parties includes a virtual service device created for each of the data collaboration parties on the cloud service platform.
  • a typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.
  • the relevant parts can refer to the partial description of the method embodiments.
  • the device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.
  • the multi-instance networking device based on blockchain described in FIG12 and the internal functional modules and structural diagram of the cross-domain data authorization described in FIG13 may actually be executed by an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute any of the above-mentioned embodiments of the multi-instance networking method based on blockchain.
  • the internal functional modules and structural diagram of the cross-domain data authorization described in Figure 13 above, its actual execution subject can be an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute any embodiment of the above-mentioned cross-domain data authorization method.
  • the processor can be a CPU, or other general-purpose processors, digital signal processors (English: Digital Signal Processor, abbreviated: DSP), application-specific integrated circuits (English: Application Specific Integrated Circuit, abbreviated: ASIC), etc.
  • the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.
  • the aforementioned memory can be a read-only memory (English: read-only memory, abbreviated: ROM), random access memory (English: random access memory, abbreviated: RAM), flash memory, hard disk or solid-state hard disk.
  • the steps of the method disclosed in conjunction with the embodiment of the present invention can be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Storage Device Security (AREA)

Abstract

本说明书实施例提供一种数据跨域授权方法及装置和电子设备。该方法包括：第一服务程序实例接收第二数据协作方通过数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识；所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。

Description

数据跨域授权方法及装置和电子设备 技术领域
本说明书实施例涉及区块链技术领域，尤其涉及一种数据跨域授权方法及装置和电子设备。
背景技术
企业或个人在跨域使用业务所需的用户数据时，一方面需要执行严格的申请审批流程，对用户数据的使用权限进行控制授权，另一方面需要通过技术手段来确保用户数据的安全转移。
而数据安全区块链(简称数安链)，就是目前应用比较广泛的一种，基于区块链技术实现的，来保障用户数据的安全转移的解决方案。通过该解决方案，可以在多个跨域的数据协作方(数据源)之间，将用户数据以密文的形式进行跨域的数据转移，但用户数据的控制权不转移。
然而，由于现有的基于数据安全区块链的数据协作平台，通常采用的是集中式的网络服务架构，随着用户数据的使用场景的日益丰富，已经逐渐的无法满足使用需求。
发明内容
本说明书实施例提供的一种数据跨域授权方法及装置和电子设备。
根据本说明书实施例的第一方面，提供一种数据跨域授权方法，所述方法应用于基于数据安全区块链的数据协作平台；数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；区块链协作平台上创建了与所述多个数据协作方中的第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；以及，与所述多个数据协作方中的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；所述服务程序实例用于对与其关联的服务设备上存储的用户数据的密文数据的跨域转移进行授权管理；所述数据协作平台为所述第一服务程序实例和所述第二服务程序实例之间创建了数据同步通道；所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述方法包括：所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识；所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。
根据本说明书实施例的第二方面，提供一种数据跨域授权装置，所述装置应用于基于数据安全区块链的数据协作平台；数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；区块链协作平台上创建了与所述多个数据协作方中的第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；以及，与所述多个数据协作方中的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；所述服务程序实例用于对与其关联的服务设备上存储的用户数据的密文数据的跨域转移进行授权管理；所述数据协作平台为所述第一服务程序实例和所述第二服务程序实例之间创建了数据同步通道；所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述装置包括：接收单元，所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识；授权单元，所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。
根据本说明书实施例的第三方面，提供一种电子设备，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为上述任一项数据跨域授权方法。
本说明书实施例，通过在数据协作平台上为接入该数据协作平台的各个数据协作方分别创建一个独立的服务程序实例，并在为各个数据协作方创建的服务程序实例之间创建数据同步通道，使得接入数据协作平台的各个数据协作方，在具有将维护的用户数据的密文数据跨域转移至其它的数据协作方的需求时，可以基于该数据同步通道与其它的数据协作方实时的进行数据同步。
附图说明
图1是本说明书一实施例提供的一种在数据协作平台中采用多实例组网的网络服务架构图。
图2是本说明书一实施例提供的一种基于区块链的多实例组网方法的流程图。
图3是本说明书一实施例提供的服务程序实例中的设备注册流程的示意图。
图4是本说明书一实施例提供的服务程序实例中的设备更新流程的示意图。
图5是本说明书一实施例提供的服务程序实例中的数据注册流程的示意图。
图6是本说明书一实施例提供的服务程序实例中的数据更新流程的示意图。
图7是本说明书一实施例提供的服务程序实例中的数据下链流程的示意图。
图8是本说明书一实施例提供的数据跨域授权方法的流程图。
图9是本说明书一实施例提供的数据跨域授权的示意图。
图10是本说明书一实施例提供的数据跨域转移的示意图。
图11是本说明书一实施例提供的基于区块链的多实例组网或者数据跨域授权装置的硬件结构图。
图12是本说明书一实施例提供的基于区块链的多实例组网装置的模块。
图13是本说明书一实施例提供的数据跨域授权装置的模块。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本说明书相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本说明书的一些方面相一致的装置和方法的例子。
在本说明书使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本说明书。在本说明书和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本说明书可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本说明书范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
数据安全区块链(简称数安链)，是一种将区块链作为底层服务的一种网络服务架构。在该网络服务架构中，作为底层服务的区块链上的区块链节点，通常可以包括多个数据协作方对应的服务设备。
其中，该多个数据协作方通常分别对应不同的数据域。需要说明的是，多个数据协作方分别对应不同的数据域，具体是指多个数据协作方对应的服务设备之间，需要跨域的进行数据传输通信。在实际应用中，不同的服务设备之间，通常可以通过域名访问地址(即url地址)来访问其他服务设备的本地数据库中存储的用户数据。当某一个服务设备在通过url地址访问另一个服务设备的过程中，如果被访问的服务设备的url地址，与发起访问的该服务设备的url地址不同，那么这两台服务设备之间的数据传输通信即被称之为跨域。在实际应用中，各个数据协作方如果对应多台服务设备，那么该多台服务设备之间可以共用同一个域名访问地址。
在数据安全区块链中，为了确保各个数据协作方维护的用户数据的使用安全，各个数据协作方维护的用户数据，通常分别存储在与各个数据协作方对应的服务设备的本地数据库中。而区块链作为一个开放的存储平台，在区块链上可以只存储各个数据协作方维护的用户数据对应的数据属性信息(也称之为数据目录)。
通过这种方式，对于任一数据协作方而言，都可以通过获取区块链上的数据属性信息，来发现由加入数据安全区块链中的其它数据协作方所发布的用户数据。当该数据协作方发现了由其它数据协作方发布的感兴趣的用户数据，还可以向该其它数据协作方发起数据授权申请，由请求授权的用户数据的拥有方来进行授权审批，在授权审批通过后，可以利用数据协作方之间的数据同步通道，将该用户数据的密文数据，跨域转移到该数据协作方。
由于在整个过程中，只是对用户数据的密文数据进行了跨域转移，用户数据的明文数据始终未出域，因此基于现有的数据安全区块链的解决方案，可以在将用户数据以密文的形式进行跨域的数据转移的基础上，确保用户数据的控制权不转移。
然而，数据安全区块链虽然极大的提升了用户数据的使用安全，但现有的基于数据安全区块链的数据协作平台中，通常采用的是基于单服务程序实例的集中式的网络服务架构。
当作为数据源的多个数据协作方对应的服务设备，分别作为区块链节点接入到数据安全区块链之后，为了对该多个数据协作方对应的服务设备的本地数据库中存储的用户数据的密文数据进行跨域转移管理，数据协作平台可以利用区块链服务平台上的资源，在该数据协作平台上为该多个数据协作方共同创建一个集中式的服务程序实例，并通过该集中式的服务程序实例，来对该多个数据协作方维护的用户数据的密文数据的跨域转移进行授权管理。
其中，上述服务程序实例具体可以是利用区块链服务平台上的资源，在区块链服务平台上创建的为该多个数据协作方提供服务的一个软件服务单元。在实际应用中，该集中式的服务程序实例，具体可以与作为区块链节点加入了上述数据安全区块链的所有服务设备相互关联，并对与其关联的所有服务设备上的本地数据库中存储的用户数据的密文数据的跨链转移进行授权管理。
例如，上述多个数据协作方中的任一数据协议方，发现了由其它数据协作方发布的感兴趣的用户数据，都可以向该集中式的服务程序实例发起数据授权申请，由该服务程序实例来进行授权审批。
在实际应用中，随着多个数据协议方相互进行数据协作的使用场景的日益丰富，不同的数据协议方之间，可能会具有通过建立数据协作关系进而形成数据协作联盟的需求。在这种需求之下，不同的数据协作方之间势必需要频繁的相互进行数据同步。
而现有的基于数据安全链的数据协作平台，由于其仍然采用单服务程序实例的集中式的网络服务架构，各个数据协作方之间天然的缺乏数据同步通道，因此显然无法满足这种需求。
有鉴于此，本说明书提出一种在基于数据安全区块链的数据协作平台上，采用多服务程序实例进行组网的分布式的网络服务架构。
在实现时，在上述数据协作方平台中，可以不再采用基于单服务程序实例的集中式的网络服务架构，对于每一个接入数据协作平台的数据协作方，均可以利用数据协作平台上的资源，为各个数据协作方分别创建一个与其对应的至少一台服务设备关联的服务程序实例，并为各个数据协作方对应的服务程序实例之间，创建数据同步通道，并通过该数据同步通道在各个数据协作方之间进行数据同步。
在以上技术方案中，由于在上述数据协作方平台中，不再采用基于单服务程序实例的集中式的网络服务架构，而是采用基于多服务程序实例进行组网的网络服务架构，数据协作平台会为接入该数据协作平台的各个数据协作方分别创建一个独立的服务程序实例，并在为各个数据协作方创建的服务程序实例之间创建数据同步通道，使得接入数据协作平台的各个数据协作方，在具有将维护的用户数据的密文数据跨域转移至其它的数据协作方的需求时，可以基于该数据同步通道与其它的数据协作方实时的进行数据同步，从而可以满足基于数据协作关系而形成数据协作联盟中的数据同步需求。
例如，基于现有的单服务程序实例的集中式的网络服务架构，由于接入数据协作平台的各个数据协作方共用同一个服务程序实例，缺乏数据同步通道，因此对于各个数据协作方来说，只能够通过定时从数据安全链上获取由其它数据协作方发布的数据集对应的数据属性信息，来发现由其它数据协作方发布的数据集，这种方式显然存在滞后性。对于作为数据使用方的数据协作方而言，无法第一时间感知到由其它数据协作方发布的最新的数据；相似地，对于作为数据提供方的数据协作方而言，也无法及时将自身发布的最新的数据通知给其它的数据协作方。
如果采用以上技术方案中的基于多服务程序实例进行组网的网络服务架构，由于在数据协作平台上为各个数据协作方分别创建了一个独立的服务程序实例，并且与各个数据协作方对应的服务实例之间打通了数据同步通道。因此，作为数据提供方的数据协作方在数据安全区块链上发布了最新的数据之后，可以通过该数据同步通道，将发布的数据在数据安全区块链上的存证标识，及时的同步到其它的数据协作方对应的服务程序实例。
请参见图1，图1为本说明书示出的一种在数据协作平台中采用多实例组网的网络服务架构图。
在本说明书中，数据协作平台可以不再采用基于单服务程序实例的集中式的网络服务架构，而采用多服务程序实例进行组网的分布式的网络服务架构。
如图1所示，图1示出的第一服务程序实例，可以是上述数据协作平台为接入该数据协作平台的第一数据协作方创建的，与该第一数据协作方对应的服务设备关联的服务程序实例。图1示出的第二服务程序实例，可以是上述数据协作平台为接入该数据协作平台的第二数据协作方创建的，与该第二数据协作方对应的服务设备关联的服务程序实例。
需要说明的是，接入数据协作平台的每一个数据协作方，均可以对应一台服务设备，也可以对应多台服务设备。当某一数据协作方接入了数据协作平台后，与该数据协作方对应的服务设备，会作为区块链节点加入数字安全区块链；例如，如图1所示，与第一数据协作方对应的服务设备包括多台，分别为服务设备1至服务设备4；与第二数据协作平台对应的服务设备包括一台，为服务设备5。
其中，上述服务程序实例，具体可以采用如图1示出的三层的服务架构，分别包括第一服务层、第二服务层和第三服务层。
第一服务层，可以是与数字安全区块链对应的应用服务层。
第二服务层，可以是与数字安全区块链对应的授权服务层。
第三服务层，可以是与数字安全区块链对应的基础服务层。
其中，无论是以上三个服务层中的哪一个服务层，均可以包括与数据协作平台上的提供的一些基础服务组件。
例如，如图1所示，如果上述数据协作平台为云服务平台，则以上三个服务层均可以包括诸如SLB(Server Load Balancer，负载均衡)和ECS(Elastic Compute Service，云服务)等服务组件。
其中，上述应用服务层，具体可以包括用于实现密文数据的跨域转移的功能的跨域转移组件、用于实现针对密文数据的加密解密功能的加解密组件，等等。
例如，如图1所示，如果上述数据协作平台为云服务平台，则上述跨域转移组件和加解密组件，均可以是基于云服务平台上的ECS服务相关的云计算资源实现的云组件。
上述授权服务层，具体可以包括用于实现针对密文数据的跨域转移进行授权管理的功能的dataAuth(数据授权)组件、用于实现针对用户数据在数字安全区块链上的区块链数字身份进行管理的DIS(Decentralized Identity Service，分布式身份服务)组件、用于实现对数字安全区块链上存储的数据进行数据中转，定时从数字安全区块链上获取数据的功能的中转服务组件，等等。
例如，如图1所示，如果上述数据协作平台为云服务平台，则上述dataAuth、DIS组件和上述中转服务，均可以是基于云服务平台上的ECS服务相关的云计算资源实现的云组件。
上述基础服务层，具体可以用于实现数字安全区块链相关的基础服务功能；例如，数据上链存证等服务功能。
例如，如图1所示，如果上述数据协作平台为云服务平台，则数据安全区块链上的各个区块链节点(即与各个数据协作方对应的服务设备)，均可以是基于云服务平台上的ECS服务相关的云计算资源创建的虚拟服务设备(比如虚拟机)。
请继续参见图1，上述应用服务层和上述授权服务层，除了可以包含若干服务组件以外，还可以包含若干数据库。
其中，上述应用服务层和上述授权服务层上包含的数据库的数据库类型，在本说明书中不进行特别限定。例如，如图1所示，可以包括MySQL、Redis、OSS、SqlLite等数据库类型。
需要说明的是，上述应用服务层上的数据库，可以作为与数据协作方对应的服务设备上的本地数据库，可以用于存储需要跨域转移的用户数据。上述授权服务层上的数据库，可以包含与该授权服务层上的各个服务组件分别对应的数据库；例如，如图1所示，授权服务层上可以包含按一个与dataAuth组件和DIS组件对应的数据库，还可以包含一个与中转服务组件对应的数据库。
其中，与dataAuth组件和DIS组件对应的数据库具体可以用于存储与用户数据的跨域转移的数据授权相关的数据。与中转服务组件对应的数据库，具体可以用于存储该组件定时从数字安全区块链上获取到的数据。
除此之外，上述第一服务程序实例和上述第二服务程序实例之间，还可以创建一个数据同步通道，用于服务程序实例之间的实时的数据同步。例如，该数据同步通道，具体可以是基于服务程序实例的调用地址(比如与该服务程序实例关联的服务设备的域名访问地址)，在服务程序实例之间创建的服务调用通道。
需要强调的是，图1示出的服务程序实例采用三层的网络服务架构的例子，仅为示例性的描述，在实际应用中，上述服务程序实例的服务层的层数，以及各个服务层上包含的组件，均可以基于实际的需求进行灵活的调整。
例如，在实际应用中，可以在图1披露的三层的网络服务架构的基础上，将图1示出的多个服务层合并为一个服务层，或者将图1示出的某一服务层进一步拆分成多个服务层，或者还可以将图1示出的多个组件按照功能合并成一个组件，或者将图1示出的某一个组件按照功能进行进一步的划分，拆分成多个组件，等等，在本说明书中不再进行一一举例。
又如，在实际应用中，当图1示出的第二数据协作方，并不允许将该第二数据协作方对应的服务设备上存储的用户数据的密文数据，跨域转移到其它的数据协作方时，此时该第二数据协作方只能作为数据使用方，而并不能作为数据提供方。在这种情况下，由于第二数据协作方并不允许将该第二数据协作方对应的服务设备上存储的用户数据的密文数据，跨域转移到其它的数据协作方的权限，授权给其它的数据协作方，因此在与该第二数据协作方对应的上述第二服务程序实例中，则可以不包含图1上示出的dataAuth组件和DIS组件。
请参见图2，图2是本说明书根据一示例性实施例示出的一种基于区块链的多实例组网方法的流程图，该方法可以应用于采用图1示出的网络服务架构的基于数据安全区块链的数据协作平台；所述数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；各个数据协作方维护的用户数据，分别存储在与所述各个数据协作方对应的服务设备的本地数据库中；所述数据安全区块链上存储了所述各个数据协作方维护的用户数据对应的数据属性信息；所述方法包括步骤210至步骤240。
步骤210，接收第一数据协作方发起的接入请求；其中，所述接入请求包括与所述第一数据协作方对应的至少一台服务设备的设备标识。
上述数据协作平台，具体可以是一个云服务平台；例如，在一个例子中，上述数据协作平台具体可以是一个区块链云服务平台。比如，上述区块链云服务平台具体可以是一个用于提供区块链即 服务(BaaS，Blockchain as a Service)的BaaS平台(也称之为BaaS云)。BaaS平台可以通过为区块链上发生的活动，提供预先编写的软件的方式，面向与BaaS平台耦接的服务设备，提供简单易用，一键部署，快速验证，灵活可定制的区块链服务，进而可以加速区块链业务应用开发、测试、上线，助力各行业区块链商业应用场景的落地。
而上述服务设备可以是数据协作方部署的本地服务设备，也可以是在云服务平台上利用云计算资源，为该数据协作方创建的虚拟服务设备。
例如，与数据协作方对应的服务设备，可以是数据协作方通过向云服务平台付费，由云服务平台，利用云服务平台上的运算资源、存储资源以及传输资源等云计算资源，为该数据协作方创建的VM虚拟机。
第一数据协作方在具有将用户数据的密文数据跨域转移至其它的数据协作方，或者想要跨域的获取已经接入上述数据协作平台的其它数据协作方维护的用户数据的密文数据时，具体可以向数据协作平台发起接入请求；其中，该接入请求具体可以包括与第一数据协作方对应的至少一台服务设备的设备标识。
步骤220，响应于所述接入请求，将所述至少一台服务设备作为区块链节点加入至所述数据安全区块链，并创建与所述第一数据协作方对应的至少一台服务设备关联的第一服务程序实例。
数据协作平台在接收到第一数据协作方发起的接入请求后，可以响应该接入请求，将该接入请求中包括的至少一个设备标识对应的至少一台服务设备作为区块链节点加入到数字安全区块链网络。
其中，将上述至少一台服务设备加入到数字安全区块链网络的具体过程，在本说明书中不再进行详述。
当第一数据协作方对应的至少一台服务设备作为区块链节点成功加入数字安全区块链网络之后，区块链协作平台还可以利用数据协作平台上的资源，在数据协作平台上创建一个与第一数据协作方对应的至少一台服务设备关联的第一服务程序实例。
步骤230，确定是否创建了与所述多个数据协作方中除了所述第一数据协作方以外的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例。
当数据协作平台为第一数据协作方创建了第一服务程序实例之后，此时数据协作平台可以进一步确定，是否按照相同的方式，为接入了数据协作平台的第二数据协作方创建了一个与该第二数据协作方对应的至少一台服务设备关联的第二服务程序实例。
步骤240，如果是，创建所述第一服务程序实例和所述第二服务程序实例之间的数据同步通道；其中，所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述服务程序实例用于对与其关联的服务设备上存储的用户数据对应的密文数据的跨链转移进行授权管理。
在数据协作平台确定已经创建了与所述多个数据协作方中除了所述第一数据协作方以外的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例的情况下，该数据协作平台可以进一步创建该第一服务程序实例和该第二服务程序实例之间的数据同步通道。其中，该数据同步通道，具体可以用于在第一服务程序实例与第二服务程序实例之间进行跨域的数据同步。
当上述第一服务程序实例和上述第二服务程序实例之间的数据同步通道创建完成之后，此时针对第一数据协作方和第二数据协作方之间的组网完成，后续第一服务程序实例和第二服务程序实例之间可以基于该数据同步通道进行实时的跨域的数据同步。
其中，需要说明的是，这里的第二数据协作方可以是指第一数据协作方之外的其它数据协作方，该其它数据协作方可以是一个也可以是多个。类似的，上述第二服务程序实例也可以是指数据协作平台为第一数据协作方之外的其它数据协作方创建的其它的服务程序实例，该其它的服务程序实例可以是一个也可以是多个。
例如，当上述第二数据协作方是指第一数据协作方之外的多个其它的数据协作方时，此时数据协作平台可以分别创建该第一服务程序实例和为该多个其它的数据协作方创建的多个服务程序实例之间的数据同步通道，以完成该第一数据协作方和上述多个其它的数据协作方之间的组网。
其中，需要说明的是，在实际应用中，上述数据协作平台为接入的各个数据协作方创建的服务程序实例，还可以按照主服务程序实例和从服务程序实例进行角色划分。
例如，在一个例子中，假定由数据安全区块链的运营方发起了一个数据协作联盟，此时该运营方可以作为该数据协作联盟的第一个数据协作方，在这种情况下，为该运营方创建的，与该运营方的至少一台服务设备关联的服务程序实例，可以作为该数据协作联盟中的主服务程序实例，而为后续加入该数据协作联盟的其它的数据协作方(比如机构)创建的服务程序实例，可以作为该数据协作联盟中的从服务程序实例。
其中，需要强调的是，将上述数据协作平台为接入的各个数据协作方创建的服务程序实例划分 为主实例和从实例，仅仅是角色上的区分，在实际应用中，主服务程序实例和从服务程序实例在功能上，则是两个完全对等且互相独立的服务实例。
在一示例性的实施例中，数据协作平台为与各个数据协作方创建的服务程序实例之间的数据同步通道，具体可以是基于服务程序实例的调用地址，在服务程序实例之间创建的服务调用通道。
其中，上述调用地址的类型，在本说明书中不进行特别限定。
在一示例性的实施例中，具体可以采用与各个服务程序实例对应的至少一台服务设备共用的域名访问地址(即url地址)，来作为各个服务程序实例对应的调用地址。
在这种情况下，各个服务程序实例之间的服务调用通道，则可以是基于各个服务程序实例对应的至少一台服务设备共用的域名访问地址，在各个服务程序实例之间构建的http调用通道。
当然，在实际应用中，上述调用地址具体也可以是其它形式的诸如接口调用地址，各个服务程序实例之间的服务调用通道，具体也可以是接口调用通道，在本说明书中不再进行一一列举。
其中，需要说明的是，由于基于调用地址形成的调用通道，通常都是单向的调用通道，因此第一服务程序实例和第二服务程序之间的服务调用通道，通常可以包括基于第一服务程序实例维护的第二服务程序实例的调用地址形成的，由第一服务程序实例作为调用发起方，上述第二服务程序实例作为被调用方的第一服务调用通道；以及，基于第二服务程序实例维护的第一服务程序实例的调用地址形成的，由第二服务程序实例作为调用发起方，上述第一服务程序实例作为被调用方的第二服务调用通道。
例如，在一个例子中，请继续参见图1，由于对于一个服务程序实例来说，位于授权服务层的dataAuth组件，从功能上区分，通常是一个服务程序实例中的核心组件；因此，在这种情况下，在为第一服务程序实例和第二服务程序实例之间创建数据同步通道时，具体可以将第二服务程序实例的url地址添加到第一服务程序实例的dataAuth组件进行维护，以在第一服务程序实例的dataAuth组件和第二服务程序实例之间形成第一http调用通道。相应的，可以将第一服务程序实例的url地址添加到第二服务程序实例的dataAuth组件进行维护，以在第二服务程序实例的dataAuth组件和第一服务程序实例之间形成第二http调用通道，以完成第一服务程序实例和第二服务程序实例之间的数据同步通道的创建。
当第一服务程序实例和第二服务程序实例之间建立了数据同步通道之后，第一服务程序实例和第二服务程序实例之间的，可以基于该数据同步通道来进行实时的数据同步。以下结合具体的数据同步场景，对第一服务程序实例和第二服务程序实例之间的数据同步过程进行详细描述。
数据同步场景一
在一示例性的实施例中，第一数据协作方需要新增一台服务设备时，此时第一数据协作方可以向第一服务程序实例发起设备注册，将该新增的服务设备与该第一服务程序实例进行关联，并在关联完成后，由该第一服务程序实例通过与第二服务程序实例之间的数据同步通道，将该新增的服务设备的设备信息，同步给第二服务程序实例。
在这种场景下，第一服务程序实例与第二服务程序实例之间通过数据同步通道同步的数据为在第一服务程序实例中新增的服务设备的设备信息。
请参见图3示出的一种服务程序实例中的设备注册流程的示意图，在图2所述实施例基础上，还可以包括：所述第一服务程序实例接收设备注册请求；其中，所述设备注册请求包括所述第一数据协作方新增的服务设备的设备信息；响应于所述设备注册请求，所述第一服务程序实例建立所述新增的服务设备和该第一服务程序实例的关联关系，并将所述新增的服务设备的设备信息和所述关联关系在与所述第一服务程序实例对应的数据库中进行存储；然后，进一步调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件进一步调用所述第一服务程序实例中的DIS组件，由所述DIS组件为所述新增的服务设备在数据安全区块链上创建数字身份信息，并将创建的数字身份信息返回所述DataAuth组件。
再进一步由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用(即图3中的callback调用(回调函数调用))，以将所述新增的服务设备的数字身份信息返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中进行存储，即存储该数字身份信息。
另外，所述DataAuth组件还可以基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，以通过所述第一服务程序实例与第二服务程序实例之间的数据同步通道将所述新增的服务设备的数字身份信息和设备信息同步至所述第二服务程序实例，并在与所述第二服务程序实例对应的数据库中进行同步存储，即存储数数字身份信息和设备信息。
其中，需要说明的是，所述数据安全区块链上部署了用于创建数字身份的智能合约。
所述DIS组件为所述新增的服务设备在所述数据安全区块链上创建数字身份信息，可以包括： 所述DIS组件调用所述数据安全区块链上部署的所述智能合约，为所述新增的服务设备在所述数据安全区块链上创建数字身份信息。
数据同步场景二
在一示例性的实施例中，第一数据协作方需要更新第一服务程序实例关联的任一目标服务设备时，此时第一数据协作方可以向第一服务程序实例发起区块链设备更新，将第一服务程序实例对应的数据库中该目标服务设备的设备信息进行更新，并通过与第二服务程序实例之间的数据同步通道，将该目标服务设备的更新后的设备信息，同步给第二服务程序实例。
在这种场景下，第一服务程序实例与第二服务程序实例之间通过数据同步通道同步的数据为在第一服务程序实例中目标服务设备的更新后的设备信息。
请参见图4示出的一种服务程序实例中的设备更新流程的示意图，在图2所述实施例基础上，还可以包括：所述第一服务程序实例接收区块链设备更新请求；其中，所述区块链设备更新请求包括与所述第一服务程序实例关联的任一目标服务设备的待更新的设备信息；响应于所述区块链设备更新请求，所述第一服务程序实例基于待更新的设备信息更新与所述第一服务程序实例对应的数据库中存储的所述目标服务设备的设备信息；然后，进一步调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件进一步调用所述第一服务程序实例中的DIS组件，由所述DIS组件在数据安全区块链上对目标服务设备的数字身份信息进行更新，并将更新后的数字身份信息返回给所述DataAuth组件。
再进一步由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用，以将更新后的数字身份信息返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中存储所述目标服务设备的更新后的数字身份信息。
另外，所述DataAuth组件还可以基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，以通过所述第一服务程序实例与第二服务程序实例之间的数据同步通道将所述目标服务设备的更新后的设备信息和更新后的数字身份信息同步至所述第二服务程序实例，对与所述第二服务程序实例对应的数据库中存储的所述目标服务设备的设备信息进行同步更新，即存储所述目标服务设备的更新后的设备信息和更新后的数字身份信息。
其中，与前述设备注册类似的，所述DIS组件在数据安全区块链上对目标服务设备的数字身份信息进行更新，可以包括：所述DIS组件调用所述数据安全区块链上部署的所述智能合约，为所述目标服务设备在数据安全区块链上创建新的数字身份信息，并将新的数字身份信息与目标服务设备的旧的数字身份信息进行关联。所创建的新的数字身份信息即为所述目标服务设备的更新后的数字身份信息。
数据同步场景三
在一示例性的实施例中，第一数据协作方需要发布本地数据库中存储的用户数据构成的数据集时，此时第一数据协作方可以向第一服务程序实例发起数据注册，生成与该数据集对应的数据属性信息，并在将该数据属性信息存证到数据安全区块链(可以得到该数据属性信息对应的区块链存证标识)后，由该第一服务程序实例通过与第二服务程序实例之间的数据同步通道，将所述区块链存证标识，同步给第二服务程序实例，以使所述第二服务程序实例基于所述区块链存证标识从数据安全区块链上获取所述数据属性信息。
在这种场景下，第一服务程序实例与第二服务程序实例之间通过数据同步通道同步的数据为数据属性信息对应的区块链存证标识。
请参见图5示出的一种服务程序实例中的数据注册流程的示意图，在图2所述实施例基础上，还可以包括：所述第一服务程序实例接收与所述第一服务程序实例关联的任一目标服务设备发送的数据注册请求；其中，所述数据注册请求包括所述目标服务设备请求注册的数据集；响应于所述数据注册请求，所述第一服务程序实例生成与所述数据集对应的数据属性信息，并将所述数据集以及所述数据属性信息存储至所述目标服务设备的本地数据库；然后，进一步调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件将与所述数据集对应的数据属性信息发布至所述数据安全区块链进行存证，以获取用于从数据安全区块链查询该上链的数据属性信息的区块链存证标识。
再进一步由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用，以将所述区块链存证标识和所述数据属性信息返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中进行存储，即将所述区块链存证标识和所述数据属性信息进行关联存储。
接着，所述第一服务程序实例调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件调用所述第一服务程序实例中的DIS组件，进一步由所述DIS组件在数据安全区块链上为所述数据集对应的数据属性信息创建包含对应区块链存证标识的数字身份信息，并将创建的数字身份信 息返回所述DataAuth组件。其中，所述DIS组件可以通过调用所述数据安全区块链上部署的所述智能合约，为所述数据属性信息在所述数据安全区块链上创建包含区块链存证标识的数字身份信息。
进一步，由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用，以将所述数据属性信息的数字身份信息返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中进行存储，即存储该数据属性信息的数字身份信息。
另外，所述DataAuth组件还可以基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，以通过所述第一服务程序实例与第二服务程序实例之间的数据同步通道将所述数据属性信息的数字身份信息同步至所述第二服务程序实例；以使所述第二服务程序实例基于该数字身份信息中包含的区块链存证标识从所述数据安全区块链上获取所述数据属性信息，并将获取到的数据属性信息在与所述第二服务程序实例对应的数据库中进行同步存储。
数据同步场景四
在一示例性的实施例中，第一数据协作方需要更新已发布的数据集时，此时第一数据协作方可以向第一服务程序实例发起数据更新，生成与更新后的数据集对应的更新后的数据属性信息，并在将该更新后的数据属性信息存证到数据安全区块链(可以得到更新后的数据属性信息对应的区块链存证标识)后，由该第一服务程序实例通过与第二服务程序实例之间的数据同步通道，将所述更新后的数据属性信息对应的区块链存证标识，同步给第二服务程序实例，以使所述第二服务程序实例基于所述区块链存证标识从数据安全区块链上获取所述更新后的数据属性信息。
在这种场景下，第一服务程序实例与第二服务程序实例之间通过数据同步通道同步的数据为更新后的数据属性信息对应的区块链存证标识。
请参见图6示出的一种服务程序实例中的数据更新流程的示意图，在图2所述实施例基础上，还可以包括：所述第一服务程序实例接收与所述第一服务程序实例关联的任一目标服务设备的数据更新请求；其中，所述数据更新请求包括所述目标服务设备请求更新的数据集；响应于所述数据更新请求，所述第一服务程序实例重新生成与所述数据集对应的更新后的数据属性信息，并更新所述目标服务设备的本地数据库中存储的所述数据集和所述数据集的数据属性信息；然后，进一步调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件将与所述数据集对应的更新后的数据属性信息发布至所述数据安全区块链进行存证，以获取用于从数据安全区块链查询该更新后的数据属性信息的区块链存证标识。
再进一步由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用，以将所述区块链存证标识和更新后的数据属性信息返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中进行存储，即将所述区块链存证标识和所述更新后的数据属性信息进行关联存储。
接着，所述第一服务程序实例调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件调用所述第一服务程序实例中的DIS组件，进一步由所述DIS组件在数据安全区块链上对于数据集对应的更新后的数据属性信息的数据身份信息进行更新，并将更新后的数字身份信息返回给所述DataAuth组件。其中，所述DIS组件可以调用所述数据安全区块链上部署的所述智能合约，为所述更新后的数据属性信息在数据安全区块链上创建新的数字身份信息，并将新的数字身份信息与更新前的数据属性信息的旧的数字身份信息进行关联。所创建的新的数字身份信息即为数据集的更新后的数字身份信息。
进一步，由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用，以将所述更新后的数字身份信息返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中进行存储，即存储更新后的的数字身份信息。
另外，所述DataAuth组件还可以基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，以通过所述第一服务程序实例与第二服务程序实例之间的数据同步通道将所述更新后的数字身份信息同步至所述第二服务程序实例；以使所述第二服务程序实例基于该更新后的数字身份信息中包含的区块链存证标识从所述数据安全区块链上获取所述更新后的数据属性信息，并将获取到的更新后的数据属性信息在与所述第二服务程序实例对应的数据库中进行同步更新。
数据同步场景五
在一示例性的实施例中，第一数据协作方需要删除发布的目标数据集时，此时第一数据协作方可以向第一服务程序实例发起数据下链，删除本地数据库中存储的所述目标数据集和所述目标数据集的数据属性信息，由该第一服务程序实例通过与第二服务程序实例之间的数据同步通道，将目标数据集的删除通知，同步给第二服务程序实例，以使所述第二服务程序实例同步删除目标数据集。
在这种场景下，第一服务程序实例与第二服务程序实例之间通过数据同步通道同步的目标数据集的数据属性信息。
请参见图7示出的一种服务程序实例中的数据注册流程的示意图，在图2所述实施例基础上，还可以包括：所述第一服务程序实例接收与所述第一服务程序实例关联的任一目标服务设备发送的数据删除请求；其中，所述数据删除请求包括所述目标服务设备请求删除的目标数据集的数据集标识；响应于所述数据删除请求，所述第一服务程序实例删除所述目标服务设备的本地数据库中存储的所述目标数据集和所述目标数据集的数据属性信息；然后，进一步调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件在数据安全链上将所述数据集的数据属性信息创建的数据身份信息设置为无效状态，以获取设置结果。
再进一步由所述DataAuth组件基于维护的所述第一服务程序实例的调用地址，发起针对所述第一服务程序实例的服务调用，以将所述设置结果返回给所述第一服务程序实例，并在与所述第一服务程序实例对应的数据库中将所述数据集和数据属性信息的状态切换为第三状态。
另外，所述DataAuth组件还可以基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，以通过所述第一服务程序实例与第二服务程序实例之间的数据同步通道将所述目标数据集的删除通知同步至所述第二服务程序实例，以触发所述第二服务程序实例基于所述删除通知将与所述第二服务程序实例对应的数据库中存储的所述目标数据集的数据属性信息同步的进行删除处理，并将该数据库中维护的数据身份信息设置为无效状态。
综上本说明书提供的基于区块链的多实例组网实施例，通过在数据协作平台上为接入该数据协作平台的各个数据协作方分别创建一个独立的服务程序实例，并在为各个数据协作方创建的服务程序实例之间创建数据同步通道，使得接入数据协作平台的各个数据协作方，在具有将维护的用户数据的密文数据跨域转移至其它的数据协作方的需求时，可以基于该数据同步通道与其它的数据协作方实时的进行数据同步。
在介绍了基于区块链的多实例组网之后，下面将进一步介绍与这个多实例组网中的数据跨域授权相关的实施例。
请参见图8，图8是本说明书根据一示例性实施例示出的一种跨域数据授权方法的流程图，该方法可以应用于采用图1示出的网络服务架构的基于数据安全区块链的数据协作平台；所述数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；区块链协作平台上创建了与所述多个数据协作方中的第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；以及，与所述多个数据协作方中的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；所述服务程序实例用于对与其关联的服务设备上存储的用户数据的密文数据的跨域转移进行授权管理；所述数据协作平台为所述第一服务程序实例和所述第二服务程序实例之间创建了数据同步通道；所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述方法包括步骤310至步骤320。
步骤310：所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识。
本说明书通过在各个数据协作方创建的服务程序实例之间创建数据同步通道，使得接入数据协作平台的各个数据协作方，在具有针对用户数据的密文数据的跨域转移的数据授权需求时，可以基于该数据同步通道与其它的数据协作方实时的进行跨域数据授权。
与前述实施例相同的，所述区块链协作平台包括区块链云服务平台；与所述各个数据协作方对应的服务设备包括在云服务平台上为各个数据协作方创建的虚拟服务设备。
所述数据协作平台为与各个数据协作方创建的服务程序实例之间的数据同步通道，例如可以是基于服务程序实例的调用地址，在服务程序实例之间创建的服务调用通道。
其中，上述调用地址的类型，在本说明书中不进行特别限定。
在一示例性的实施例中，具体可以采用与各个服务程序实例对应的至少一台服务设备共用的域名访问地址(即url地址)，来作为各个服务程序实例对应的调用地址。
在这种情况下，各个服务程序实例之间的服务调用通道，则可以是基于各个服务程序实例对应的至少一台服务设备共用的域名访问地址，在各个服务程序实例之间构建的http调用通道。
当然，在实际应用中，上述调用地址具体也可以是其它形式的诸如接口调用地址，各个服务程序实例之间的服务调用通道，具体也可以是接口调用通道，在本说明书中不再进行一一列举。
在一示例性的实施例中，所述步骤310，可以包括：响应于所述第二服务程序实例基于维护的所述第一服务程序实例的第一调用地址，发起的针对所述第一服务程序实例的服务调用，获取与所述服务调用对应的调用参数中携带的针对所述第一数据协作方维护的用户数据的数据授权请求。
其中，需要说明的是，由于基于调用地址形成的调用通道，通常都是单向的调用通道，因此第一服务程序实例和第二服务程序之间的服务调用通道，通常可以包括基于第一服务程序实例维护的第二服务程序实例的调用地址形成的，由第一服务程序实例作为调用发起方，上述第二服务程序实例作为被调用方的第一服务调用通道；以及，基于第二服务程序实例维护的第一服务程序实例的调用地址形成的，由第二服务程序实例作为调用发起方，上述第一服务程序实例作为被调用方的第二服务调用通道。
当第二数据协作方具有针对第一数据协作方发布的用户数据的密文数据的跨域转移的数据授权需求时，可以通过数据同步通道向所述第一数据协作方对应的第一服务程序实例发起针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识。
步骤320：所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。
下面结合图9所示的数据跨域授权的示意图加以说明，当第一服务程序实例接收到数据授权请求之后，响应于所述数据授权请求，调用所述第一服务程序实例中的DataAuth组件，由所述DataAuth组件将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果(如图9中的授权凭证)通过所述第一服务程序实例和所述第二服务程序实例之间的数据同步通道返回给所述第二服务程序实例。
在一示例性的实施例中，所述第一数据协作方为维护的用户数据配置了授权审批流程；其中，所述审批流程包括所述第一数据协作方指定的至少一个审批方。
所述步骤320中第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，包括：所述第一服务程序实例响应于所述数据授权请求，获取所述第一数据协作方为所述目标用户数据配置的授权审批流程，并触发执行所述授权审批流程，以及响应于所述授权审批流程中包含的各个审批方均审批通过，为所述第二数据协作方生成授权凭证，以将所述目标用户数据的密文数据的跨域转移权限授权给所述第二数据协作方。
例如，每个审批方可以产生5种审批状态：待审批、审批通过、拒绝、撤销、免审批；其中，撤销可以是授权审批流程的申请方(如第二数据协作方)在授权审批流程结束前的任何时刻发起，撤销的授权审批流程立即终止，审批结果为撤销审批。
在授权审批时，按照授权审批流程中的顺序，如果当前审批方获取到的授权审批流程的状态为待审批的状态，则该授权审批流程暂停执行，需要等待当前审批方上传审批结果(审批通过、拒绝、免审批中的一种)后继续执行；如果上传的是拒绝，则授权审批流程立即终止，并将拒绝审批的审批结果通知给申请方。如果上传的是审批通过或免审批，按照授权审批流程的顺序确定是否还有下一个审批方，如果有则下一个审批方将成为新的当前审批方，并切换为待审批的状态；如果没有，则结束授权审批流程，审批结果为各个审批方均审批通过。
其中，第一数据协作方可以指定授权审批流程，所述申请审批流程可以包括默认流程、自定义流程和免审批流程等；其中，默认流程可以是指先由第二数据协作方作为审批方进行审批，再由第一数据协作方作为审批方进行审批；所述自定义流程可以是由第一数据协作方自定义的审批流程。
如图9所示，所述第一服务程序实例通过调用第一服务程序实例中的DataAuth组件，由所述DataAuth组件进行授权处理，以为所述第二数据协作方生成授权凭证，以将所述目标用户数据的密文数据的跨域转移权限授权给所述第二数据协作方。
其中，所述将授权结果通过所述数据同步通道返回给所述第二服务程序实例，可以包括：基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述授权凭证作为调用参数同步至所述第二服务程序实例。
在一示例性的实施例中，在将所述授权凭证同步至所述第二服务程序实例之前，还包括：将所述授权凭证发布至所述数据安全区块链进行存证；相应的，所述将所述授权凭证作为调用参数同步至所述第二服务程序实例，包括：将所述授权凭证在所述数据安全区块链上的存证标识作为调用参数同步至所述第二服务程序实例，以使所述第二服务程序实例基于所述存证标识从所述数据安全区块链上获取所述授权凭证。
如图9中所示可以通过调用DataAuth组件将所述授权凭证发布至所述数据安全区块链进行存证；通过将授权凭证存证到数据安全区块链，确保授权凭证不被篡改。
由于数据安全区块链中存证的数据会有一个唯一的存证标识，因此所述将所述授权凭证同步至所述第二服务程序实例，可以包括：将所述授权凭证在所述数据安全区块链上的存证标识，同步至 所述第二服务程序实例，以使所述第二服务程序实例基于所述存证标识从所述数据安全区块链上获取所述授权凭证。
在一示例性的实施例中，如图9中所示在将所述授权凭证同步至所述第二服务程序实例之前，还可以包括：由DataAuth组件生成针对所述目标用户数据的密文数据的跨域转移权限的授权记录，并将生成的所述授权记录发布至所述数据安全区块链进行存证。
在一示例性的实施例中，所述第一数据协作方为维护的用户数据配置了数据使用规则；其中，所述数据使用规则定义了针对所述用户数据的使用的限制规则。
所述方法还包括：响应于触发的向所述第二数据协作方跨域转移所述目标用户数据的密文数据的转移任务，基于所述数据使用规则生成针对所述目标用户数据进行使用的使用程序，并通过所述数据同步通道，将所述使用程序和所述目标用户数据的密文数据转移至所述第二服务程序实例，以由所述第二服务程序实例运行所述使用程序，基于所述使用程序包含的所述数据使用规则针对所述目标用户数据的密文数据进行密文计算。
其中，所述通过所述数据同步通道，将所述使用程序和所述目标用户数据的密文数据转移至所述第二服务程序实例，包括：基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述使用程序和所述目标用户数据的密文数据作为调用参数转移至所述第二服务程序实例。
如图9所示，当第一服务程序实例中的DataAuth组件在监听到数据安全链上针对目标用户数据的授权记录或跨域转移记录时就可以立即触发上述的转移任务。
本说明书中，所述转移任务可以是在所述第一服务程序实例中的DataAuth组件监听到数据安全链上存证的授权记录时触发的；也可以是所述DataAuth组件监听到链上存证的转移记录是触发的。
与前述授权记录类型的，这里DataAuth组件可以生成将所述目标用户数据的密文数据对应的跨域转移记录，并将生成的所述跨域转移记录发布至所述数据安全链进行存证。所述密文数据转移可以是在转移记录成功上链后执行的，也可以是先进行密文数据转移再上链存证转移记录；一般的，前一种方式相对更为安全。
本说明书中，所述数据使用规则，可以包括以下示出的任一或者多个的组合：使用模式限制规则；其中，所述使用模式限制规则定义了针对所述目标用户数据的密文数据进行操作时限制使用的操作类型；所述操作类型可以包括允许的计算方式和处理方式。例如允许全等查询、允许模糊查询、允许字符串连接、允许字符串长度大小、允许截取子串、允许字符串转小写、允许字符串转大写等等。
使用次数限制规则；其中，所述使用次数限制规则定义了针对所述目标用户数据的密文数据进行操作时限制使用的使用次数。
脱敏限制规则；其中，所述脱敏限制规则定义了针对所述目标用户数据的密文数据进行密文计算得到的密文结果对应的明文内容的脱敏策略。所述脱敏策略例如哈希脱敏、遮羞脱敏、假名脱敏等等。
其中，所述使用程序包括SDK程序包。
本说明书中，所述SDK程序包中包含的是与上述的数据使用规则相关的一些函数。这些函数限制对目标用户数据的密文数据的使用。比如，规定只能对密文数据进行A运算，那SDK程序包只包含与A运算相关的计算函数(算子)。
在一示例性的实施例中，所述方法还可以包括：所述第一服务程序实例接收所述第二服务程序实例通过所述数据同步通道发起的解密请求；其中，所述解密请求包括针对所述目标用户数据的密文数据进行密文计算得到的密文计算结果和所述授权凭证；所述第一服务程序实例响应于所述解密请求，针对所述授权凭证进行验证，并响应于针对所述授权凭证的验证通过，对所述密文计算结果进行解密得到明文计算结果，并基于所述数据使用规则中包含的脱敏限制规则中定义的脱敏策略，对所述明文计算结果进行脱敏处理，并通过所述数据同步通道将所述脱敏处理后的明文计算结果同步至所述第二服务程序实例。
进一步参考图10所示的数据跨域转移的示意图，在第一服务程序实例通过数据同步通道将使用程序以及目标用户数据对应的密文数据发送给第二服务程序实例之后，所述第二服务程序实例就可以在使用程序指定的数据使用规则的限制下，对密文数据进行相关业务的密文计算。由于是对密文数据进行密文计算，因此计算得到也是密文的计算结果；由于计算结果是密文的，因此第二服务程序实例还需要调用第二服务程序实例中的DataAuth组件，由所述DataAuth组件通过数据同步通道将这个密文的计算结果和授权凭证发送给第一服务程序实例；进而由所述第一服务程序实例中的DataAuth组件对授权凭证进行验证，验证通过后进一步有DataAuth组件对密文的计算结果进行解密，并将解密的明文的计算结果通过数据同步通道返回给第二服务程序实例。
其中，所述第一服务程序实例接收所述第二服务程序实例通过所述数据同步通道发起的解密请求，包括：响应于所述第二服务程序实例基于维护的所述第一服务程序实例的第一调用地址，发起的针对所述第一服务程序实例的服务调用，获取与所述服务调用对应的调用参数中携带的解密请求；通过所述数据同步通道将所述脱敏处理后的明文计算结果同步至所述第二服务程序实例，包括：基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述脱敏处理后的明文计算结果作为调用参数同步至所述第二服务程序实例。
综上本说明书提供的数据跨域授权实施例，通过在数据协作平台上为接入该数据协作平台的各个数据协作方分别创建一个独立的服务程序实例，并在为各个数据协作方创建的服务程序实例之间创建数据同步通道，使得接入数据协作平台的各个数据协作方，在具有将维护的用户数据的密文数据跨域转移至其它的数据协作方的需求时，可以基于该数据同步通道与其它的数据协作方实时的进行数据同步。
与前述基于区块链的多实例组网方法实施例相对应，本说明书还提供了基于区块链的多实例组网装置的实施例。所述装置实施例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，作为一个逻辑意义上的装置，是通过其所在设备的处理器将非易失性存储器中对应的计算机程序读取到内存中运行形成的。从硬件层面而言，如图11所示，为本说明书基于区块链的多实例组网装置所在设备的一种硬件结构图，除了图11所示的处理器、网络接口、内存以及非易失性存储器之外，实施例中装置所在的设备通常根据数据同步实际功能，还可以包括其他硬件，对此不再赘述。
请参见图12，为本说明书一实施例提供的基于区块链的多实例组网装置的模块图，所述装置对应了图2所示实施例。所述装置应用于基于数据安全区块链的数据协作平台；所述数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；所述装置包括：接收单元410，接收第一数据协作方发起的接入请求；其中，所述接入请求包括与所述第一数据协作方对应的至少一台服务设备的设备标识；响应单元420，响应于所述接入请求，将所述至少一台服务设备作为区块链节点加入至所述数据安全区块链，并创建与所述第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；确定单元430，确定是否创建了与所述多个数据协作方中除了所述第一数据协作方以外的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；组网单元440，在创建了与所述多个数据协作方中除了所述第一数据协作方以外的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例的情况下，创建所述第一服务程序实例和所述第二服务程序实例之间的数据同步通道；其中，所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述服务程序实例用于对与其关联的服务设备上存储的用户数据对应的密文数据的跨链转移进行授权管理。
在一示例性的实施例中，所述数据同步通道包括基于所述服务程序实例的调用地址，在所述服务程序实例之间创建的服务调用通道。
在一示例性的实施例中，与所述服务程序实例对应的调用地址，包括与所述服务程序实例关联的服务设备的域名访问地址；所述调用通道包括http调用通道。
在一示例性的实施例中，所述装置还包括：第一接收子单元，所述第一服务程序实例接收设备注册请求；其中，所述设备注册请求包括所述第一数据协作方新增的服务设备的设备信息；第一响应子单元，响应于所述设备注册请求，所述第一服务程序实例建立所述新增的服务设备和该第一服务程序实例的关联关系，并将所述新增的服务设备的设备信息和所述关联关系在与所述第一服务程序实例对应的数据库中进行存储；以及，第一同步子单元，基于维护的与所述第二服务程序实例对应的调用地址，发起针对所述第二服务程序实例的服务调用，将所述新增的服务设备的设备信息同步至所述第二服务程序实例，在与所述第二服务程序实例对应的数据库中进行同步存储。
在一示例性的实施例中，所述装置还包括：第二接收子单元，所述第一服务程序实例接收区块链设备更新请求；其中，所述区块链设备更新请求包括与所述第一服务程序实例关联的任一目标服务设备的待更新的设备信息；第二响应子单元，响应于所述区块链设备更新请求，所述第一服务程序实例基于待更新的设备信息更新与所述第一服务程序实例对应的数据库中存储的所述目标服务设备的设备信息；以及，第二同步子单元，基于维护的与所述第二服务程序实例对应的调用地址，发起针对所述第二服务程序实例的服务调用，将所述目标服务设备的更新后的设备信息同步至所述第二服务程序实例，对与所述第二服务程序实例对应的数据库中存储的所述目标服务设备的设备信息进行同步更新。
在一示例性的实施例中，所述装置还包括：第三接收子单元，所述第一服务程序实例接收与所述第一服务程序实例关联的任一目标服务设备发送的数据注册请求；其中，所述数据注册请求包括所述目标服务设备请求注册的数据集；第三响应子单元，响应于所述数据注册请求，所述第一服务 程序实例生成与所述数据集对应的数据属性信息，并将所述数据集以及所述数据属性信息存储至所述目标服务设备的本地数据库；以及，第三同步子单元，将与所述数据集对应的数据属性信息发布至所述数据安全区块链进行存证，并基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，将与所述数据属性信息对应的区块链存证标识同步至所述第二服务程序实例，以使所述第二服务程序实例基于该区块链存证标识从所述数据安全区块链上获取所述数据属性信息，并将获取到的数据属性信息在与所述第二服务程序实例对应的数据库中进行同步存储。
在一示例性的实施例中，所述装置还包括：第四接收子单元，所述第一服务程序实例接收与所述第一服务程序实例关联的任一目标服务设备的数据更新请求；其中，所述数据更新请求包括所述目标服务设备请求更新的数据集；第四响应子单元，响应于所述数据更新请求，所述第一服务程序实例重新生成与所述数据集对应的更新后的数据属性信息，并更新所述目标服务设备的本地数据库中存储的所述数据集和所述数据集的数据属性信息；以及，第四同步子单元，所述第一服务程序实例将与所述数据集对应的更新后的数据属性信息发布至所述数据安全区块链进行存证，基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，将所述更新后的数据属性信息的区块链存证标识同步至所述第二服务程序实例，以使所述第二服务程序实例基于该区块链存证标识从所述数据安全区块链上获取所述更新后的数据属性信息，并基于获取到的更新后的数据属性信息对与所述第二服务程序实例对应的数据库中存储的与所述数据集对应的数据属性信息进行同步更新。
在一示例性的实施例中，所述装置还包括：第五接收子单元，所述第一服务程序实例接收与所述第一服务程序实例关联的任一目标服务设备发送的数据删除请求；其中，所述数据删除请求包括所述目标服务设备请求删除的目标数据集的数据集标识；第五响应子单元，响应于所述数据删除请求，所述第一服务程序实例删除所述目标服务设备的本地数据库中存储的所述目标数据集和所述目标数据集的数据属性信息；第五同步子单元，基于维护的所述第二服务程序实例的调用地址，发起针对所述第二服务程序实例的服务调用，以将所述目标数据集的删除通知同步至所述第二服务程序实例，以触发所述第二服务程序实例基于所述删除通知将与所述第二服务程序实例对应的数据库中存储的所述目标数据集的数据属性信息同步的进行删除处理。
在一示例性的实施例中，所述装置还包括：所述数据协作平台包括区块链云服务平台；与所述各个数据协作方对应的服务设备包括在云服务平台上为各个数据协作方创建的虚拟服务设备。
请参见图13，为本说明书一实施例提供的数据跨域授权装置的模块图，所述装置对应了图8所示实施例。所述装置应用于基于数据安全区块链的数据协作平台；所述数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；区块链协作平台上创建了与所述多个数据协作方中的第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；以及，与所述多个数据协作方中的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；所述服务程序实例用于对与其关联的服务设备上存储的用户数据的密文数据的跨域转移进行授权管理；所述数据协作平台为所述第一服务程序实例和所述第二服务程序实例之间创建了数据同步通道；所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述装置包括：接收单元510，所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识；授权单元520，所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。
在一示例性的实施例中，所述数据同步通道包括基于所述服务程序实例的调用地址，在所述服务程序实例之间创建的服务调用通道。
在一示例性的实施例中，与所述服务程序实例对应的调用地址，包括与所述服务程序实例关联的服务设备的域名访问地址；所述调用通道包括http调用通道。
在一示例性的实施例中，所述接收单元510，包括：响应于所述第二服务程序实例基于维护的所述第一服务程序实例的第一调用地址，发起的针对所述第一服务程序实例的服务调用，获取与所述服务调用对应的调用参数中携带的针对所述第一数据协作方维护的用户数据的数据授权请求。
在一示例性的实施例中，所述第一数据协作方为维护的用户数据配置了授权审批流程；其中，所述审批流程包括所述第一数据协作方指定的至少一个审批方；所述授权单元520中的第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，包括：所述第一服务程序实例响应于所述数据授权请求，获取所述第一数据协作方为所述目标用户数据配置的授权审批流程，并触发执行所述授权审批流程，以及响应于所 述授权审批流程中包含的各个审批方均审批通过，为所述第二数据协作方生成授权凭证，以将所述目标用户数据的密文数据的跨域转移权限授权给所述第二数据协作方。
在一示例性的实施例中，所述授权单元520中的将授权结果通过所述数据同步通道返回给所述第二服务程序实例，包括：基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述授权凭证作为调用参数同步至所述第二服务程序实例。
在一示例性的实施例中，在所述将授权结果通过所述数据同步通道返回给所述第二服务程序实例，所述授权单元520还包括：将所述授权凭证发布至所述数据安全区块链进行存证；所述授权单元520中的将所述授权凭证同步至所述第二服务程序实例，包括：将所述授权凭证在所述数据安全区块链上的存证标识作为调用参数同步至所述第二服务程序实例，以使所述第二服务程序实例基于所述存证标识从所述数据安全区块链上获取所述授权凭证。
在一示例性的实施例中，在将所述授权凭证同步至所述第二服务程序实例之前，所述授权单元520还包括：生成针对所述目标用户数据的密文数据的跨域转移权限的授权记录，并将生成的所述授权记录发布至所述数据安全区块链进行存证。
在一示例性的实施例中，所述第一数据协作方为维护的用户数据配置了数据使用规则；其中，所述数据使用规则定义了针对所述用户数据的使用的限制规则；所述装置还包括：计算单元，响应于触发的向所述第二数据协作方跨域转移所述目标用户数据的密文数据的转移任务，基于所述数据使用规则生成针对所述目标用户数据进行使用的使用程序，并通过所述数据同步通道，将所述使用程序和所述目标用户数据的密文数据转移至所述第二服务程序实例，以由所述第二服务程序实例运行所述使用程序，基于所述使用程序包含的所述数据使用规则针对所述目标用户数据的密文数据进行密文计算。
在一示例性的实施例中，所述计算单元中的通过所述数据同步通道，将所述使用程序和所述目标用户数据的密文数据转移至所述第二服务程序实例，包括：基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述使用程序和所述目标用户数据的密文数据作为调用参数转移至所述第二服务程序实例。
在一示例性的实施例中，还包括：存证子单元，生成将所述目标用户数据的密文数据对应的跨域转移记录，并将生成的所述跨域转移记录发布至所述数据安全区块链进行存证。
在一示例性的实施例中，所述数据使用规则，包括以下示出的任一或者多个的组合：使用模式限制规则；其中，所述使用模式限制规则定义了针对所述目标用户数据的密文数据进行操作时限制使用的操作类型；使用次数限制规则；其中，所述使用次数限制规则定义了针对所述目标用户数据的密文数据进行操作时限制使用的使用次数；脱敏限制规则；其中，所述脱敏限制规则定义了针对所述目标用户数据的密文数据进行密文计算得到的密文结果对应的明文内容的脱敏策略。
在一示例性的实施例中，所述使用程序包括SDK程序包。
在一示例性的实施例中，所述装置还包括：接收子单元，所述第一服务程序实例接收所述第二服务程序实例通过所述数据同步通道发起的解密请求；其中，所述解密请求包括针对所述目标用户数据的密文数据进行密文计算得到的密文计算结果和所述授权凭证；解密子单元，所述第一服务程序实例响应于所述解密请求，针对所述授权凭证进行验证，并响应于针对所述授权凭证的验证通过，对所述密文计算结果进行解密得到明文计算结果，并基于所述数据使用规则中包含的脱敏限制规则中定义的脱敏策略，对所述明文计算结果进行脱敏处理，并通过所述数据同步通道将所述脱敏处理后的明文计算结果同步至所述第二服务程序实例。
在一示例性的实施例中，所述接收子单元，包括：响应于所述第二服务程序实例基于维护的所述第一服务程序实例的第一调用地址，发起的针对所述第一服务程序实例的服务调用，获取与所述服务调用对应的调用参数中携带的解密请求；通过所述数据同步通道将所述脱敏处理后的明文计算结果同步至所述第二服务程序实例，包括：基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述脱敏处理后的明文计算结果作为调用参数同步至所述第二服务程序实例。
在一示例性的实施例中，所述区块链协作平台包括区块链云服务平台；与各个所述数据协作方对应的服务设备包括在云服务平台上为各个数据协作方创建的虚拟服务设备。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
上述装置中各个单元的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本说明书方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上图12描述的基于区块链的多实例组网装置以及图13描述的数据跨域授权的内部功能模块和结构示意，其实质上的执行主体可以为一种电子设备，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行上述任一基于区块链的多实例组网方法的实施例。
以上图13描述的数据跨域授权的内部功能模块和结构示意，其实质上的执行主体可以为一种电子设备，包括：处理器；用于存储处理器可执行指令的存储器；其中，所述处理器被配置为执行上述任一数据跨域授权方法的实施例。
在上述电子设备的实施例中，应理解，该处理器可以是CPU，还可以是其他通用处理器、数字信号处理器(英文：Digital Signal Processor，简称：DSP)、专用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC)等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，而前述的存储器可以是只读存储器(英文：read-only memory，缩写：ROM)、随机存取存储器(英文：random access memory，简称：RAM)、快闪存储器、硬盘或者固态硬盘。结合本发明实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于电子设备实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本说明书的其它实施方案。本说明书旨在涵盖本说明书的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本说明书的一般性原理并包括本说明书未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本说明书的真正范围和精神由下面的权利要求指出。
应当理解的是，本说明书并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本说明书的范围仅由所附的权利要求来限制。

Claims (19)

  1. 一种数据跨域授权方法，所述方法应用于基于数据安全区块链的数据协作平台；所述数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；所述区块链协作平台上创建了与所述多个数据协作方中的第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；以及，与所述多个数据协作方中的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；所述服务程序实例用于对与其关联的服务设备上存储的用户数据的密文数据的跨域转移进行授权管理；所述数据协作平台为所述第一服务程序实例和所述第二服务程序实例之间创建了数据同步通道；所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述方法包括：
    所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识；
    所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。
  2. 根据权利要求1所述的方法，其中，所述数据同步通道包括基于所述服务程序实例的调用地址，在所述服务程序实例之间创建的服务调用通道。
  3. 根据权利要求2所述的方法，其中，与所述服务程序实例对应的调用地址，包括与所述服务程序实例关联的服务设备的域名访问地址；所述调用通道包括http调用通道。
  4. 根据权利要求2所述的方法，其中，所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求，包括：
    响应于所述第二服务程序实例基于维护的所述第一服务程序实例的第一调用地址，发起的针对所述第一服务程序实例的服务调用，获取与所述服务调用对应的调用参数中携带的针对所述第一数据协作方维护的用户数据的数据授权请求。
  5. 根据权利要求2所述的方法，其中，所述第一数据协作方为维护的用户数据配置了授权审批流程；其中，所述审批流程包括所述第一数据协作方指定的至少一个审批方；
    所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，包括：
    所述第一服务程序实例响应于所述数据授权请求，获取所述第一数据协作方为所述目标用户数据配置的授权审批流程，并触发执行所述授权审批流程，以及响应于所述授权审批流程中包含的各个审批方均审批通过，为所述第二数据协作方生成授权凭证，以将所述目标用户数据的密文数据的跨域转移权限授权给所述第二数据协作方。
  6. 根据权利要求5所述的方法，其中，所述将授权结果通过所述数据同步通道返回给所述第二服务程序实例，包括：
    基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述授权凭证作为调用参数同步至所述第二服务程序实例。
  7. 根据权利要求6所述的方法，其中，在将所述授权凭证同步至所述第二服务程序实例之前，还包括：
    将所述授权凭证发布至所述数据安全区块链进行存证；
    所述将所述授权凭证同步至所述第二服务程序实例，包括：
    将所述授权凭证在所述数据安全区块链上的存证标识作为调用参数同步至所述第二服务程序实例，以使所述第二服务程序实例基于所述存证标识从所述数据安全区块链上获取所述授权凭证。
  8. 根据权利要求7所述的方法，其中，将所述授权凭证同步至所述第二服务程序实例之前，还包括：
    生成针对所述目标用户数据的密文数据的跨域转移权限的授权记录，并将生成的所述授权记录发布至所述数据安全区块链进行存证。
  9. 根据权利要求2所述的方法，其中，所述第一数据协作方为维护的用户数据配置了数据使用规则；其中，所述数据使用规则定义了针对所述用户数据的使用的限制规则；
    所述方法还包括：
    响应于触发的向所述第二数据协作方跨域转移所述目标用户数据的密文数据的转移任务，基于所述数据使用规则生成针对所述目标用户数据进行使用的使用程序，并通过所述数据同步通道，将所述使用程序和所述目标用户数据的密文数据转移至所述第二服务程序实例，以由所述第二服务程序实例运行所述使用程序，基于所述使用程序包含的所述数据使用规则针对所述目标用户数据的密文数据进行密文计算。
  10. 根据权利要求9所述的方法，其中，所述通过所述数据同步通道，将所述使用程序和所述目标用户数据的密文数据转移至所述第二服务程序实例，包括：
    基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述使用程序和所述目标用户数据的密文数据作为调用参数转移至所述第二服务程序实例。
  11. 根据权利要求9所述的方法，还包括：
    生成将所述目标用户数据的密文数据对应的跨域转移记录，并将生成的所述跨域转移记录发布至所述数据安全区块链进行存证。
  12. 根据权利要求9所述的方法，其中，所述数据使用规则，包括以下示出的任一或者多个的组合：
    使用模式限制规则；其中，所述使用模式限制规则定义了针对所述目标用户数据的密文数据进行操作时限制使用的操作类型；
    使用次数限制规则；其中，所述使用次数限制规则定义了针对所述目标用户数据的密文数据进行操作时限制使用的使用次数；
    脱敏限制规则；其中，所述脱敏限制规则定义了针对所述目标用户数据的密文数据进行密文计算得到的密文结果对应的明文内容的脱敏策略。
  13. 根据权利要求9所述的方法，其中，所述使用程序包括SDK程序包。
  14. 根据权利要求9所述的方法，所述方法还包括：
    所述第一服务程序实例接收所述第二服务程序实例通过所述数据同步通道发起的解密请求；其中，所述解密请求包括针对所述目标用户数据的密文数据进行密文计算得到的密文计算结果和所述授权凭证；
    所述第一服务程序实例响应于所述解密请求，针对所述授权凭证进行验证，并响应于针对所述授权凭证的验证通过，对所述密文计算结果进行解密得到明文计算结果，并基于所述数据使用规则中包含的脱敏限制规则中定义的脱敏策略，对所述明文计算结果进行脱敏处理，并通过所述数据同步通道将所述脱敏处理后的明文计算结果同步至所述第二服务程序实例。
  15. 根据权利要求14所述的方法，其中，所述第一服务程序实例接收所述第二服务程序实例通过所述数据同步通道发起的解密请求，包括：
    响应于所述第二服务程序实例基于维护的所述第一服务程序实例的第一调用地址，发起的针对所述第一服务程序实例的服务调用，获取与所述服务调用对应的调用参数中携带的解密请求；
    通过所述数据同步通道将所述脱敏处理后的明文计算结果同步至所述第二服务程序实例，包括：
    基于维护的所述第二服务程序实例的第二调用地址，发起针对所述第二服务程序实例的服务调用，将所述脱敏处理后的明文计算结果作为调用参数同步至所述第二服务程序实例。
  16. 根据权利要求1所述的方法，其中，所述区块链协作平台包括区块链云服务平台；与各个数据协作方对应的服务设备包括在云服务平台上为各个数据协作方创建的虚拟服务设备。
  17. 一种数据跨域授权装置，所述装置应用于基于数据安全区块链的数据协作平台；所述数据安全区块链中的区块链节点包括与多个数据协作方分别对应的服务设备；所述区块链协作平台上创建了与所述多个数据协作方中的第一数据协作方对应的至少一台服务设备关联的第一服务程序实例；以及，与所述多个数据协作方中的第二数据协作方对应的至少一台服务设备关联的第二服务程序实例；所述服务程序实例用于对与其关联的服务设备上存储的用户数据的密文数据的跨域转移进行授权管理；所述数据协作平台为所述第一服务程序实例和所述第二服务程序实例之间创建了数据同步通道；所述多个数据协作方分别对应不同的数据域；所述数据同步通道用于在所述第一服务程序实例与所述第二服务程序实例之间进行跨域的数据同步；所述装置包括：
    接收单元，所述第一服务程序实例接收所述第二数据协作方通过所述数据同步通道发起的针对所述第一数据协作方维护的用户数据的数据授权请求；其中，所述数据授权请求包括所述第二数据协作方请求授权的目标用户数据的数据标识；
    授权单元，所述第一服务程序实例响应于所述数据授权请求，将所述目标用户数据的密文数据的跨域转移权限针对所述第二数据协作方进行授权处理，并将授权结果通过所述数据同步通道返回给所述第二服务程序实例。
  18. 一种电子设备，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器被配置为执行上述权利要求1-16中任一项所述的方法。
  19. 一种计算机可读存储介质，当所述计算机可读存储介质中的指令由电子设备的处理器执行时，使得所述电子设备能够执行如权利要求1-16中任一项所述的方法。
PCT/CN2022/135265 2022-10-31 2022-11-30 数据跨域授权方法及装置和电子设备 WO2024092929A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211351840.3 2022-10-31
CN202211351840.3A CN115766123A (zh) 2022-10-31 2022-10-31 数据跨域授权方法及装置和电子设备

Publications (1)

Publication Number Publication Date
WO2024092929A1 true WO2024092929A1 (zh) 2024-05-10

Family

ID=85354801

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/135265 WO2024092929A1 (zh) 2022-10-31 2022-11-30 数据跨域授权方法及装置和电子设备

Country Status (2)

Country Link
CN (1) CN115766123A (zh)
WO (1) WO2024092929A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115801344A (zh) * 2022-10-31 2023-03-14 蚂蚁区块链科技(上海)有限公司 基于区块链的多实例组网方法及装置和电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210303552A1 (en) * 2020-03-30 2021-09-30 Oracle International Corporation Distributed and blockchain-based ledgers for data cloud services
US20210365943A1 (en) * 2020-03-06 2021-11-25 Guardtime Sa Verifiable Transfer of Data Using Sharded Blockchain
CN114157581A (zh) * 2020-09-07 2022-03-08 北京金山云网络技术有限公司 提供区块链服务的方法、装置、存储介质和电子设备
CN114219490A (zh) * 2022-01-13 2022-03-22 平安普惠企业管理有限公司 交易行为数据的更新方法、装置、设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210365943A1 (en) * 2020-03-06 2021-11-25 Guardtime Sa Verifiable Transfer of Data Using Sharded Blockchain
US20210303552A1 (en) * 2020-03-30 2021-09-30 Oracle International Corporation Distributed and blockchain-based ledgers for data cloud services
CN114157581A (zh) * 2020-09-07 2022-03-08 北京金山云网络技术有限公司 提供区块链服务的方法、装置、存储介质和电子设备
CN114219490A (zh) * 2022-01-13 2022-03-22 平安普惠企业管理有限公司 交易行为数据的更新方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN115766123A (zh) 2023-03-07

Similar Documents

Publication Publication Date Title
US10402578B2 (en) Management of encrypted data storage
US10469460B2 (en) Data sharing in a blockchain-enabled trust domain
US10623272B2 (en) Authenticating connections and program identity in a messaging system
WO2018095416A1 (zh) 信息处理方法、装置及系统
CN113364735B (zh) 多链场景下数据跨链访问控制方法、系统、设备及终端
WO2021115449A1 (zh) 跨域访问系统、方法及装置、存储介质及电子装置
US7454421B2 (en) Database access control method, database access controller, agent processing server, database access control program, and medium recording the program
JP2013522773A (ja) 複数のウェブサービスにわたって認証を実施するプラグ可能なトークンプロバイダモデル
WO2016131171A1 (zh) 一种针对vnf包进行操作的方法及装置
US10999370B1 (en) Syncing and sharing data across systems
WO2022193984A1 (zh) 跨链进行数据传输的方法、装置、计算机设备、存储介质和计算机程序产品
WO2023124746A1 (zh) 跨子网交互的权限控制
WO2024092929A1 (zh) 数据跨域授权方法及装置和电子设备
WO2024001022A1 (zh) 跨子网调用
CN115328645A (zh) 计算任务调度方法、计算任务调度装置及电子设备
WO2017211161A1 (zh) 基于软件定义网络的资源管理方法及装置
US10785056B1 (en) Sharing a subnet of a logically isolated network between client accounts of a provider network
WO2022037239A1 (en) System and methods for supporting artificial intelligence service in a network
CN105743922B (zh) 域间通信的方法、装置以及系统
WO2024092928A1 (zh) 基于区块链的多实例组网方法及装置和电子设备
US20150242501A1 (en) Social network address book
CN113612732B (zh) 一种资源调用方法、装置和多方安全计算系统
US11283609B2 (en) Method and apparatus for supporting secure data routing
JP2009031831A (ja) コミュニティ通信ネットワーク、通信制御方法、コミュニティ管理サーバ、コミュニティ管理方法、およびプログラム
CN113590711A (zh) 一种高弹性可扩展的多链数据分级共享存储系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22964225

Country of ref document: EP

Kind code of ref document: A1