WO2025251507A1 - 数据处理方法、数据处理系统、装置 - Google Patents

数据处理方法、数据处理系统、装置

Info

Publication number
WO2025251507A1
WO2025251507A1 PCT/CN2024/127860 CN2024127860W WO2025251507A1 WO 2025251507 A1 WO2025251507 A1 WO 2025251507A1 CN 2024127860 W CN2024127860 W CN 2024127860W WO 2025251507 A1 WO2025251507 A1 WO 2025251507A1
Authority
WO
WIPO (PCT)
Prior art keywords
data block
verification
data
user
broadcast
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2024/127860
Other languages
English (en)
French (fr)
Inventor
王巍
李华楠
邓桓
徐丹
李鑫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Telecom Corp Ltd Technology Innovation Center
China Telecom Corp Ltd
Original Assignee
China Telecom Corp Ltd Technology Innovation Center
China Telecom Corp Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Telecom Corp Ltd Technology Innovation Center, China Telecom Corp Ltd filed Critical China Telecom Corp Ltd Technology Innovation Center
Publication of WO2025251507A1 publication Critical patent/WO2025251507A1/zh
Pending legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • This disclosure relates to the field of cybersecurity technology, and more specifically, to a data processing method, a data processing system, a data processing device, a computer program product, and an electronic device.
  • a management domain is a collection of resources, and the behavior within a domain is subject to a system management policy.
  • a management domain contains corresponding controllers.
  • Networks in different management domains are managed by different controllers, and to ensure data security, the relationships between management domains are untrusted. However, for services that cross management domains, if an execution failure occurs, the untrusted relationship between management domains can easily affect the efficiency of fault tracing and service activation.
  • a data processing method comprising:
  • the data block will be uploaded to the blockchain.
  • verifying the business information check value in the data block includes:
  • it further includes:
  • the verification will fail.
  • it further includes:
  • the data blocks are stored in the user business data block warehouse function module.
  • the data block is generated by the target controller, which verifies the data block through a distributed ledger consensus mechanism and broadcasts the data block verification result to the central orchestrator, each domain orchestrator, and each controller.
  • the domain orchestrator and the controller are connected via a full mesh connection; wherein the full mesh connection is used to transmit data blocks.
  • a data processing system comprising:
  • Target domain orchestrator/target controller broadcast data blocks
  • controllers in response to the data block, verify the business information check value in the data block; if the verification passes, they broadcast their own verification result and receive other verification results broadcast by each domain orchestrator and each controller; when the number of other verification results received reaches a preset number, the data block is uploaded to the chain.
  • a data processing apparatus comprising:
  • the verification unit is configured to verify the business information verification value in the data block in response to the data block;
  • the broadcast unit is configured to broadcast its own verification result if the verification passes, and to receive data from each domain orchestrator and controller. Other verification results broadcast by the device;
  • the on-chain unit is configured to upload a data block to the blockchain when the number of other verification results received reaches a preset number.
  • the verification unit verifies the service information verification value in the data block, including:
  • it further includes:
  • the judgment unit is configured to determine that the verification fails if the user ID is inconsistent with the user ID carried in the data block, or if the business ID is inconsistent with the business ID carried in the data block.
  • it further includes:
  • the storage unit is configured to store data blocks in the user business data block warehouse function module.
  • the data block is generated by the target controller, which verifies the data block through a distributed ledger consensus mechanism and broadcasts the data block verification result to the central orchestrator, each domain orchestrator, and each controller.
  • the domain orchestrator and the controller are connected via a full mesh connection; wherein the full mesh connection is used to transmit data blocks.
  • a computer program product including a computer program and a method for implementing any of the above when the computer program is executed by a processor.
  • an electronic device comprising: a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to perform a method of any of the above by executing the executable instructions.
  • Figure 1 schematically illustrates a flowchart of a data processing method according to an embodiment of the present disclosure
  • FIG. 1 schematically illustrates the management domain architecture of the relevant technologies
  • Figure 3 schematically illustrates a management domain architecture diagram according to an embodiment of the present disclosure
  • Figure 4 schematically illustrates the contents of a data block according to an embodiment of the present disclosure
  • Figure 5 schematically illustrates a data block transfer method characterized by architecture according to one embodiment of the present disclosure
  • Figure 6 schematically illustrates an application scenario architecture diagram according to an embodiment of the present disclosure
  • Figure 7 schematically illustrates a flowchart of a data processing method according to another embodiment of the present disclosure.
  • Figure 8 schematically illustrates the structural diagram of a data processing system according to an embodiment of the present disclosure
  • Figure 9 schematically illustrates a structural block diagram of a data processing apparatus according to one embodiment of the present disclosure.
  • Figure 10 schematically illustrates the structure of a computer system suitable for implementing an electronic device according to embodiments of the present disclosure.
  • Figure 1 schematically illustrates a flowchart of a data processing method according to an embodiment of the present disclosure.
  • the data processing method may include steps S110 to S130.
  • Step S110 In response to the data block, verify the business information verification value in the data block.
  • Step S120 If the verification passes, broadcast the verification result and receive other verification results broadcast by each domain orchestrator and each controller.
  • Step S130 When the number of other verification results received reaches a preset number, upload the data block to the blockchain.
  • this disclosure proposes a user business data block warehouse function module, which is configured to execute the technical solutions defined in steps S110 to S130.
  • each management domain does not include a user business data block warehouse functional module. See Figure 2 for details, which schematically illustrates the management domain architecture of the related technologies.
  • the management domain of the related technologies includes: a domain orchestrator 210, a network controller 220, and network infrastructure 230.
  • the network controller 220 includes a policy formulation module 221, a topology management module 222, a traffic scheduling and optimization module 223, a policy management module 224, a topology acquisition module 225, a traffic monitoring module 226, and a policy and rule translation module 227.
  • the domain orchestrator 210 is configured to implement business orchestration functions
  • the network controller 220 is configured to manage the network
  • the network infrastructure 230 consists of devices in the network controlled by the network controller 220.
  • the policy formulation module 221 is configured to limit control policies
  • the topology management module 222 is configured to manage network topology
  • the traffic scheduling and optimization module 223 is configured to perform traffic scheduling and traffic optimization
  • the policy management module 224 is configured to manage network control policies
  • the topology acquisition module 225 is configured to collect topology information
  • the traffic monitoring module 226 is configured to monitor traffic
  • the policy and rule translation module 227 is configured to translate/standardize various policies and rules.
  • Figure 2 does not include the user business data block warehouse function module, making it difficult to achieve data verification between management domains and increase the level of trust between management domains.
  • the management domain includes: a domain orchestrator 310, a network controller 320, and network infrastructure 330.
  • the network controller 320 includes a policy formulation module 331, a topology management module 322, a traffic scheduling and optimization module 323, a policy management module 324, a topology acquisition module 325, a traffic monitoring module 326, a policy and rule translation module 327, and a user service data block repository module 328.
  • the user service data block repository module 328 is located within each controller in the network and is configured to store all service data chains, verify received user service data blocks, and upload verified service data blocks to the chain.
  • the user service data block repository module 328 can also receive user service data blocks sent by each domain orchestrator and each controller, and verify, store, and upload these data blocks to the chain. This enhances the security and traceability of service configuration information in large networks spanning multiple management domains, reducing the probability of malicious attacks and tampering with existing network service configuration information. Furthermore, it improves the security of management domains. A high level of trust between them is beneficial for improving the configuration efficiency of services across management domains.
  • step S110 in response to the data block, the verification value of the business information in the data block is verified.
  • the data block transmits the data corresponding to the current service.
  • the content of the data block includes, but is not limited to, the user ID 410, service ID 420, service verification value 430, and service configuration information 440 shown in Figure 4.
  • user ID 410 is used as a directional representation of the user initiating the service
  • service ID 420 is used as a directional representation of the current service
  • service verification value 430 is used as a basis for verifying the data block
  • service configuration information 440 is used to represent the configuration required by the current service.
  • step S110 the responding data block comes from the target controller/target domain orchestrator.
  • the target controller and the target domain orchestrator belong to the same management domain, which is any one of multiple management domains.
  • Figure 5 schematically illustrates a data block transmission method represented by the architecture according to an embodiment of this disclosure.
  • the management domain includes: a domain orchestrator 510, a network controller 520, and a network infrastructure 530.
  • the network controller 520 includes a policy formulation module 351, a topology management module 522, a traffic scheduling and optimization module 523, a policy management module 524, a topology acquisition module 525, a traffic monitoring module 526, a policy and rule translation module 527, and a user service data block repository module 528.
  • the user service data block repository module 528 can receive data blocks sent by each domain orchestrator/controller 540, thereby verifying the service information verification values in the data blocks. When the verification is successful, it broadcasts its own verification result and receives other verification results broadcast by each domain orchestrator and controller.
  • Figure 6 schematically illustrates an application scenario architecture diagram according to an embodiment of this disclosure.
  • the system includes a central orchestrator 610, a domain orchestrator 621, a controller 622, an AS 623, a domain orchestrator 631, a controller 632, an AS 633, a domain orchestrator 641, a controller 642, and an AS 634.
  • the domain orchestrator 631 if the controller 632 generates a data block, the domain orchestrator 631 can broadcast the data block to the central orchestrator 610 and other domain orchestrators and controllers to trigger verification of the data block by all parties.
  • an AS autonomous system
  • An AS refers to a group of routers and networks under the control of a management organization. Specifically, it can be implemented as a router directly connected to a LAN and also connected to the Internet.
  • An AS can be multiple LANs interconnected by an enterprise backbone network. All routers in an autonomous system are interconnected, run the same routing protocol, and are assigned the same autonomous system number. Generally, an AS can only run one routing protocol.
  • the data block is generated by the target controller, which verifies the data block through a distributed ledger consensus mechanism and broadcasts the data block verification result to the central orchestrator, each domain orchestrator, and each controller.
  • this optional embodiment enables the target domain orchestrator to broadcast data blocks after verification based on a distributed ledger consensus mechanism, and to put the data blocks on the chain using blockchain technology, thereby solving the problem of trust difficulties between management domains.
  • a distributed ledger is a database based on blockchain technology, distributed across multiple nodes, each node possessing a complete copy of the ledger. All nodes reach consensus through a consensus mechanism to ensure the integrity and security of the ledger.
  • Distributed ledgers can record and store various types of data, including transaction records, identity information, ownership of items, and more.
  • the core of a distributed ledger lies in blockchain technology, which records data in chronological order in consecutive blocks and protects the security and trustworthiness of the data through cryptographic techniques and consensus mechanisms. Each block contains the hash value of the previous block, forming an immutable chain structure, thereby guaranteeing the integrity and immutability of the data.
  • the central orchestrator manages the domain orchestrators, and each management includes the corresponding domain orchestrator and controller.
  • the domain orchestrator and the controller are connected via a full mesh connection; wherein the full mesh connection is used to transmit data blocks.
  • a full-mesh connection refers to a network connection method where all nodes... All connections are made directly between them.
  • network devices are organized together in a mesh topology, and each network node has a physical circuit/virtual circuit connected to all other network nodes.
  • verifying the business information checksum in the data block includes:
  • implementing this optional embodiment can enable information verification based on data blocks, thereby facilitating the confirmation of the legality of data blocks.
  • the business information verification value is generated by the target controller based on the user ID and the business ID.
  • it also includes:
  • the verification will fail.
  • implementing this optional embodiment can prevent illegitimate data from being verified.
  • the data block can be determined to be invalid, and therefore the verification can be considered to have failed.
  • step S120 if the verification passes, the verification result is broadcast and other verification results broadcast by each domain orchestrator and each controller are received.
  • the results can be sent to other domain orchestrators and controllers, and other verification results broadcast by each domain orchestrator and controller can be received to count the number of other verification results and use this as the basis for on-chain verification.
  • it also includes:
  • the data blocks are stored in the user business data block warehouse function module.
  • implementing this optional embodiment can enrich the functional types of the user business data block warehouse functional module and enhance its capabilities.
  • the user business data block warehouse function module has a storage function, which stores data blocks in the user business data block warehouse function module, making it easy to call them directly.
  • step S130 when the number of other verification results received reaches a preset number, the data block is uploaded to the blockchain.
  • the preset number can be half the total number of orchestrators and controllers in each domain. Therefore, the preset number depends on the specific total number of orchestrators and controllers in each domain.
  • the preset number depends on the specific total number of orchestrators and controllers in each domain.
  • Figure 7 schematically illustrates a flowchart of a data processing method according to another embodiment of the present disclosure.
  • the data processing method includes steps S710 to S750.
  • Step S710 In response to the data block, parse the user ID and business ID from the business information verification value; wherein, the data block is generated by the target controller, which is used to verify the data block through the distributed ledger consensus mechanism and broadcast the data block verification result to the central orchestrator, each domain orchestrator and each controller.
  • Step S720 If the user ID is consistent with the user ID carried in the data block, and the business ID is consistent with the business ID carried in the data block, then the verification is deemed successful; if the user ID is inconsistent with the user ID carried in the data block, or the business ID is inconsistent with the business ID carried in the data block, then the verification is deemed unsuccessful.
  • Step S730 If the verification passes, broadcast the verification result and receive other verification results broadcast by each domain orchestrator and each controller.
  • Step S740 Save the data block in the user business data block warehouse function module.
  • Step S750 When the number of other verification results received reaches a preset number, upload the data block to the blockchain.
  • steps S710 to S750 correspond to the steps and their embodiments shown in Figure 1.
  • steps S710 to S750 please refer to the steps and their embodiments shown in Figure 1, which will not be repeated here. Description.
  • implementing the method shown in Figure 7 allows for the verification of business information checksums in data blocks. Upon successful verification, the results are broadcast. When the number of verification results reaches a preset threshold, the data block can be uploaded to the blockchain. In the event of failures during business execution, this avoids the problems of low fault tracing efficiency and low service activation efficiency caused by untrusted relationships between management domains. Specifically, it leverages the multi-point storage and immutability characteristics of blockchain technology to ensure traceability for every operation and that operation records cannot be tampered with, thereby improving fault tracing efficiency and service activation efficiency. Furthermore, it enhances the overall network's resistance to malicious attacks and information tampering, thereby increasing trust between different management domains.
  • Figure 8 schematically illustrates a structural diagram of a data processing system according to an embodiment of the present disclosure.
  • the data processing system 800 includes:
  • Target Domain Orchestrator/Target Controller 810 Broadcast Data Block
  • controllers 820 in response to data blocks, verify the business information verification values in the data blocks; if the verification passes, they broadcast their own verification results and receive other verification results broadcast by each domain orchestrator and each controller; when the number of other verification results received reaches a preset number, they upload the data block to the blockchain.
  • implementing the system shown in Figure 8 allows for the verification of business information checksums in data blocks. Upon successful verification, the results are broadcast. When the number of verification results reaches a preset threshold, the data block can be uploaded to the blockchain. In the event of failures during business execution, this avoids the problems of low fault tracing efficiency and low service activation efficiency caused by untrusted relationships between management domains. Specifically, it leverages the multi-point storage and immutability characteristics of blockchain technology to ensure traceability of every operation and that operation records cannot be tampered with, thereby improving fault tracing efficiency and service activation efficiency. Furthermore, it enhances the overall network's resistance to malicious attacks and information tampering, thereby increasing trust between different management domains.
  • FIG. 9 schematically illustrates a structural block diagram of a data processing apparatus according to one embodiment of the present disclosure.
  • the data processing apparatus 900 corresponds to the method shown in Figure 1.
  • the data processing apparatus 900 includes:
  • Verification unit 901 is configured to verify the business information verification value in the data block in response to the data block;
  • Broadcast unit 902 is configured to broadcast its own verification result if the verification passes, and to receive other verification results broadcast by each domain orchestrator and each controller;
  • the on-chain unit 903 is configured to upload the data block to the chain when the number of other verification results received reaches a preset number.
  • the device shown in Figure 9 can verify the business information checksum in the data block and broadcast the verification result after successful verification.
  • the data block can be uploaded to the blockchain.
  • this avoids the problems of low fault tracing efficiency and low service activation efficiency caused by untrusted relationships between management domains.
  • it leverages the multi-point storage and immutability characteristics of blockchain technology to ensure that every operation is traceable and that operation records cannot be tampered with, thus improving fault tracing efficiency and service activation efficiency.
  • it enhances the overall network's resistance to malicious attacks and information tampering, thereby increasing trust between different management domains.
  • the verification unit 901 verifies the service information verification value in the data block, including:
  • implementing this embodiment can achieve information verification based on data blocks, which is beneficial for confirming the legitimacy of data blocks.
  • it further includes:
  • the judgment unit is configured to determine that the verification fails if the user ID is inconsistent with the user ID carried in the data block, or if the business ID is inconsistent with the business ID carried in the data block.
  • implementing this embodiment can prevent illegitimate data from being verified.
  • it further includes:
  • the storage unit is configured to store data blocks in the user business data block warehouse function module.
  • the data block is generated by the target controller, which verifies the data block through a distributed ledger consensus mechanism and broadcasts the data block verification result to the central orchestrator, each domain orchestrator, and each controller.
  • implementing this embodiment enables the target domain orchestrator to broadcast data blocks after verification based on the distributed ledger consensus mechanism, and to put the data blocks on the chain using blockchain technology, thereby solving the problem of trust difficulties between management domains.
  • the domain orchestrator and the controller are connected via a full mesh connection; wherein the full mesh connection is used to transmit data blocks.
  • modules or units of a device configured to perform actions have been mentioned in the detailed description above, this division is not mandatory.
  • the features and functions of two or more modules or units described above can be embodied in one module or unit.
  • the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
  • Figure 10 shows a schematic diagram of the structure of a computer system suitable for implementing an electronic device according to embodiments of the present disclosure.
  • the computer system 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1002 or programs loaded from storage portion 1008 into random access memory (RAM) 1003.
  • the RAM 1003 also stores various programs and data required for system operation.
  • the CPU 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004.
  • An input/output (I/O) interface 1005 is also connected to the bus 1004.
  • I/O interface 1005 The following components are connected to I/O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc.
  • the communication section 1009 performs communication processing via a network such as the Internet.
  • Drive 1010 is also connected to I/O interface 1005 as needed.
  • Removable media 1011 such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1010 as needed so that computer programs read from them can be installed into storage section 1008 as needed.
  • embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts.
  • the computer program can be downloaded and installed from a network via communication section 1009, and/or installed from removable medium 1011.
  • CPU central processing unit
  • Exemplary embodiments of this disclosure also provide a computer program product.
  • the computer program product includes a computer program that, when executed by a processor, implements the data processing method described above.
  • the computer program product can be a tangible product containing a computer program, such as a computer-readable storage medium storing the computer program.
  • the readable storage medium can be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to: random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory, hard disk drive (HDD), solid-state drive (SSD), etc.
  • RAM random access memory
  • ROM read-only memory
  • ROM magnetic tape
  • floppy disk flash memory
  • HDD hard disk drive
  • SSD solid-state drive
  • a computer program can be implemented as a non-volatile storage medium storing computer programs, such as read-only memory, NAND flash memory, etc.
  • the computer program product can be an intangible product containing a computer program.
  • the computer program product can be implemented as a virtual digital product, such as an executable file, installation package, or other digital file storing the computer program.
  • Computer program code can be written in one or more programming languages. Examples of programming languages include C, Java, and C++. Program code can execute entirely on the user's computing device, partially on the user's computing device, or as a standalone software package. It can also execute partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via an internet connection provided by a mobile network operator).
  • LAN local area network
  • WAN wide area network
  • an external computing device e.g., via an internet connection provided by a mobile network operator
  • Computer programs can be carried or transmitted via signals such as electricity, magnetism, light, electromagnetic fields, and infrared radiation.
  • Electronic devices can convert signals carrying computer programs into digital signals, thereby running the computer programs.
  • a computer program runs on an electronic device, its code is configured to cause the electronic device to execute (more specifically, to be executed by the processor of the electronic device) the method steps of various exemplary embodiments of this disclosure.
  • the data processing method described above can be executed, which includes the following steps: in response to a data block, verifying the business information verification value in the data block; if the verification passes, broadcasting the verification result and receiving other verification results broadcast by each domain orchestrator and each controller; when the number of other verification results received reaches a preset number, uploading the data block to the blockchain.
  • the verification values of business information in the data block can be verified.
  • the verification result is broadcast.
  • the data block can be uploaded to the blockchain.
  • this avoids the problems of low fault tracing efficiency and low service activation efficiency caused by untrusted relationships between management domains.
  • it ensures that every operation is traceable and that operation records cannot be tampered with, thus improving fault tracing efficiency and service activation efficiency.
  • it enhances the overall network's resistance to malicious attacks and information tampering, thereby increasing trust between different management domains.
  • each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function.
  • the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved.
  • each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
  • the units described in the embodiments of this disclosure can be implemented in software or hardware, and the described units can also be located in a processor.
  • the names of these units do not necessarily limit the unit itself.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Bioethics (AREA)
  • Virology (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种数据处理方法、数据处理系统、数据处理装置、计算机程序产品及电子设备，涉及网络安全技术领域，该方法可以对数据块中的业务信息校验值进行验证（S110），并在验证通过后广播验证结果（S120），当各验证结果的数量达到预设数量时，可以将数据块上链（S130），在面对业务执行过程中出现故障的情况时，可以避免因管理域之间的不可信关系导致的故障溯源效率低和服务启用效率低的问题，即可以利用区块链技术的多点存储、不可篡改等特性，保证每次操作均可溯源，且操作记录无法被篡改，有利于提升故障溯源效率和服务启用效率。此外，还可以提升整体网络对恶意攻击和信息篡改的抵抗能力，进而提升不同管理域之间的信任。

Description

数据处理方法、数据处理系统、装置
相关申请的交叉引用
本公开要求于2024年06月06日提交的申请号为202410733424.2、名称为“数据处理方法、数据处理系统、装置”的中国专利申请的优先权，该中国专利申请的全部内容通过引用全部并入本文。
技术领域
本公开涉及网络安全技术领域，具体而言，涉及一种数据处理方法、数据处理系统、数据处理装置、计算机程序产品及电子设备。
背景技术
一般来说，大型网络中通常会包含多个管理域，管理域是一些资源的集合，域内的行为服从于一个系统管理的政策，管理域包含相应的控制器。
不同管理域的网络由不同控制器管理，为了确保数据安全，各管理域之间的关系为不可信关系。但是，对于跨管理域的业务来说，若存在执行故障，各管理域之间的不可信关系容易影响故障溯源效率和服务启用效率。
发明内容
根据本公开的一方面，提供一种数据处理方法，该方法包括：
响应于数据块，对数据块中的业务信息校验值进行验证；
若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；
当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
在本公开的一种示例性实施例中，对数据块中的业务信息校验值进行验证，包括：
从业务信息校验值中解析出用户ID和业务ID；
若用户ID与数据块中携带的用户ID一致，且业务ID与数据块中携带的业务ID一致，则判定验证通过。
在本公开的一种示例性实施例中，还包括：
若用户ID与数据块中携带的用户ID不一致，或者，业务ID与数据块中携带的业务ID不一致，则判定验证不通过。
在本公开的一种示例性实施例中，还包括：
将数据块保存在用户业务数据块仓库功能模块中。
在本公开的一种示例性实施例中，其中：数据块由目标控制器生成，目标控制器用于通过分布式账本共识机制验证数据块，并向中央编排器、各域编排器、各控制器广播数据块验证结果。
在本公开的一种示例性实施例中，其中：域编排器和控制器之间通过全网状连接方式进行连接；其中，全网状连接用于传递数据块。
根据本公开的一方面，提供一种数据处理系统，包括：
目标域编排器/目标控制器，广播数据块；
其他控制器，响应于数据块，对数据块中的业务信息校验值进行验证；若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
根据本公开的一方面，提供一种数据处理装置，包括：
验证单元，被配置为响应于数据块，对数据块中的业务信息校验值进行验证；
广播单元，被配置为若验证通过，则广播本方验证结果，并接收各域编排器和各控制 器广播的其他验证结果；
上链单元，被配置为当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
在本公开的一种示例性实施例中，验证单元对数据块中的业务信息校验值进行验证，包括：
从业务信息校验值中解析出用户ID和业务ID；
若用户ID与数据块中携带的用户ID一致，且业务ID与数据块中携带的业务ID一致，则判定验证通过。
在本公开的一种示例性实施例中，还包括：
判定单元，被配置为若用户ID与数据块中携带的用户ID不一致，或者，业务ID与数据块中携带的业务ID不一致，则判定验证不通过。
在本公开的一种示例性实施例中，还包括：
保存单元，被配置为将数据块保存在用户业务数据块仓库功能模块中。
在本公开的一种示例性实施例中，其中：数据块由目标控制器生成，目标控制器用于通过分布式账本共识机制验证数据块，并向中央编排器、各域编排器、各控制器广播数据块验证结果。
在本公开的一种示例性实施例中，其中：域编排器和控制器之间通过全网状连接方式进行连接；其中，全网状连接用于传递数据块。
根据本公开的一方面，提供一种计算机程序产品，包括计算机程序，计算机程序被处理器执行时实现上述任意一项的方法。
根据本公开的一方面，提供一种电子设备，包括：处理器；以及存储器，被配置为存储处理器的可执行指令；其中，处理器配置为经由执行可执行指令来执行上述任意一项的方法。
附图说明
图1示意性示出了根据本公开的一个实施例的数据处理方法的流程图；
图2示意性示出了相关技术的管理域架构示意图；
图3示意性示出了根据本公开的一个实施例的管理域架构图；
图4示意性示出了根据本公开的一个实施例的数据块的内容示意图；
图5示意性示出了根据本公开的一个实施例中的通过架构表征的数据块传递方式示意图；
图6示意性示出了根据本公开的一个实施例的应用场景架构图；
图7示意性示出了根据本公开的另一个实施例的数据处理方法的流程图；
图8示意性示出了根据本公开的一个实施例的数据处理系统的结构图；
图9示意性示出了根据本公开的一个实施例中的数据处理装置的结构框图；
图10示意性示出了适于用来实现本公开实施例的电子设备的计算机系统的结构示意图。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施方式中。在下面的描述中，提供许多具体细节从而给出对本公开的实施方式的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而省略所述特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺 主而使得本公开的各方面变得模糊。
此外，附图仅为本公开的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
请参阅图1，图1示意性示出了根据本公开的一个实施例的数据处理方法的流程图。如图1所示，该数据处理方法可以包括：步骤S110～步骤S130。
步骤S110：响应于数据块，对数据块中的业务信息校验值进行验证。
步骤S120：若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果。
步骤S130：当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
实施图1所示的方法，可以对数据块中的业务信息校验值进行验证，并在验证通过后广播验证结果，当各验证结果的数量达到预设数量时，可以将数据块上链，在面对业务执行过程中出现故障的情况时，可以避免因管理域之间的不可信关系导致的故障溯源效率低和服务启用效率低的问题，即可以利用区块链技术的多点存储、不可篡改等特性，保证每次操作均可溯源，且操作记录无法被篡改，有利于提升故障溯源效率和服务启用效率。此外，还可以提升整体网络对恶意攻击和信息篡改的抵抗能力，进而提升不同管理域之间的信任。
下面，对于本示例实施方式的上述步骤进行更加详细的说明。
为了提升各管理域之间的信任度，本公开提出了一种用户业务数据块仓库功能模块，用户业务数据块仓库功能模块被配置为执行步骤S110～步骤S130限定的技术方案。
相关技术中，各管理域不包含用户业务数据块仓库功能模块，具体可以参阅图2，图2示意性示出了相关技术的管理域架构示意图。如图2所示，相关技术的管理域包括：域编排器210、网络控制器220、网络基础设施230。其中，网络控制器220包括策略制定模块221、拓扑管理模块222、流量调度与优化模块223、策略管理模块224、拓扑采集模块225、流量监控模块226、策略与规则翻译模块227。其中，域编排器210被配置为实现业务编排功能，网络控制器220被配置为给管理所在网络、网络基础设施230是使用网络控制器220所控制的网络的设备。策略制定模块221被配置为限定控制策略、拓扑管理模块222被配置为管理网络拓扑、流量调度与优化模块223被配置为执行流量调度和流量优化、策略管理模块224被配置为管理网络控制策略、拓扑采集模块225被配置为采集拓扑信息、流量监控模块226被配置为对流量进行监控、策略与规则翻译模块227被配置为翻译/标准化各类策略和规则。
可见，图2不包含用户业务数据块仓库功能模块，因此难以实现管理域之间的数据验证，难以增加管理域之间的信任度。
本公开设置了用户业务数据块仓库功能模块，具体可以参阅图3，图3示意性示出了根据本公开的一个实施例的管理域架构图。如图3所示，管理域包括：域编排器310、网络控制器320、网络基础设施330。其中，网络控制器320包括策略制定模块331、拓扑管理模块322、流量调度与优化模块323、策略管理模块324、拓扑采集模块325、流量监控模块326、策略与规则翻译模块327、用户业务数据块仓库功能模块328。其中，用户业务数据块仓库功能模块328设置于网络中各控制器内，被配置为保存所有业务数据链，并对接收的用户业务数据块进行验证，并将通过验证的业务数据块上链。以及，用户业务数据块仓库功能模块328还可以接收各域编排器和各控制器发送的用户业务数据块，并对此进行验证、存储和上链。这样可以在跨多个管理域的大型网络中，提升业务配置信息的安全性和可溯源性，降低现网业务配置信息被恶意攻击和篡改的概率。以及，提升了管理域之 间的信任度，有利于提升跨管理域的业务的配置效率。
在步骤S110中，响应于数据块，对数据块中的业务信息校验值进行验证。
具体地，数据块传递的是当前业务对应的数据，数据块的内容包括但不限于图4所示的用户ID410、业务ID420、业务校验值430、业务配置信息440。其中，用户ID410用于作为发起业务的用户的指向性表征，业务ID420用于作为当前业务的指向性表征，业务校验值430用于作为一种校验数据块的依据，业务配置信息440用于表征当前业务所需的配置。
在步骤S110中，所响应的数据块来自于目标控制器/目标域编排器，目标控制器和目标域编排器同属一个管理域，该管理域是多个管理域中的任一个。
具体可以参阅图5，图5示意性示出了根据本公开的一个实施例中的通过架构表征的数据块传递方式示意图。如图5所示，同样地，管理域包括：域编排器510、网络控制器520、网络基础设施530。其中，网络控制器520包括策略制定模块351、拓扑管理模块522、流量调度与优化模块523、策略管理模块524、拓扑采集模块525、流量监控模块526、策略与规则翻译模块527、用户业务数据块仓库功能模块528。对于用户业务数据块仓库功能模块528来说，可以接收各域编排器/各控制器540发送的数据块，从而对数据块中的业务信息校验值进行验证，并在验证通过时，广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果。
进一步可以参阅图6，图6示意性示出了根据本公开的一个实施例的应用场景架构图。如图6所示，包括中央编排器610、域编排器621、控制器622、AS 623、域编排器631、控制器632、AS 633、域编排器641、控制器642、AS 634。以域编排器631为例，若控制器632生成了数据块，域编排器631可以向中央编排器610以及其他各域编排器和各控制器广播该数据块，以触发各方对数据块进行验证。其中，AS(autonomous system)系统指的是处于一个管理机构控制之下的路由器和网络群组，具体可以实现为一个路由器直接连接到一个LAN上，同时也连到Internet上。AS可以是一个由企业骨干网互连的多个局域网，在一个自治系统中的所有路由器相互连接，运行相同的路由协议，分配同一个自治系统编号。一般来说，一个AS只能运行一种路由协议。
作为一种可选的实施例，其中：数据块由目标控制器生成，目标控制器用于通过分布式账本共识机制验证数据块，并向中央编排器、各域编排器、各控制器广播数据块验证结果。
可见，实施该可选的实施例，可以使得目标域编排器基于分布式账本共识机制使得在数据块验证后得以广播，并利用区块链技术将数据块上链，从而解决管理域之间难以信任的问题。
具体地，分布式账本，是一种基于区块链技术的数据库，分散存储在多个节点上，每个节点具备一份完整的账本副本。所有的节点通过共识机制达成一致，以确保账本的完整性和安全性。分布式账本可以记录和存储各种类型的数据，包括交易记录、身份信息、物品的所有权等等。分布式账本的核心在于区块链技术，具体是将数据按照时间顺序记录在连续的区块中，并通过密码学技术和共识机制保护数据的安全性和可信度。每个区块都包含前一个区块的哈希值，形成一个不可篡改的链式结构，从而保证数据的完整性和不可修改性。
此外，中央编排器用管理各域编排器，每个管理包括相应的域编排器和控制器。
作为一种可选的实施例，其中：域编排器和控制器之间通过全网状连接方式进行连接；其中，全网状连接用于传递数据块。
可见，实施该可选的实施例，可以使得域编排器和控制器之间可以直接传递数据块，从而有利于提升对于数据块的传递效率。
具体地，全网状连接方式(Full-mesh)，表示的是网络的一种连接形式，即所有结点 之间均以直接连接的形式进行连接。在Full-mesh所描述的网络结构中，网络设备以网状拓扑被组织在一起，每个网络节点都有一条物理电路/一条虚拟电路与所有其他网络节点相连。
作为一种可选的实施例，对数据块中的业务信息校验值进行验证，包括：
从业务信息校验值中解析出用户ID和业务ID；
若用户ID与数据块中携带的用户ID一致，且业务ID与数据块中携带的业务ID一致，则判定验证通过。
可见，实施该可选的实施例，可以实现基于数据块的信息验证，从而有利于确认数据块的合法性。
具体地，业务信息校验值是目标控制器基于用户ID和业务ID生成得到的。
作为一种可选的实施例，还包括：
若用户ID与数据块中携带的用户ID不一致，或者，业务ID与数据块中携带的业务ID不一致，则判定验证不通过。
可见，实施该可选的实施例，可以避免不合法数据被验证通过。
具体地，若用户ID与数据块中携带的用户ID不一致，或者，业务ID与数据块中携带的业务ID不一致，可以判定数据块不合法，因此可以认为验证不通过。
在步骤S120中，若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果。
具体地，验证通过后可以向其他各域编排器和各控制器，同时收各域编排器和各控制器广播的其他验证结果，以便统计其他验证结果的数量，并以此作为上链依据。
作为一种可选的实施例，还包括：
将数据块保存在用户业务数据块仓库功能模块中。
可见，实施该可选的实施例，可以丰富用户业务数据块仓库功能模块的功能种类，提升用户业务数据块仓库功能模块的能力。
具体地，用户业务数据块仓库功能模块具备存储功能，将数据块保存在用户业务数据块仓库功能模块中，可以便于直接调用。
在步骤S130中，当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
具体地，预设数量可以为各域编排器和各控制器的数量总和的一半，因此，预设数量取决于各域编排器和各控制器的具体数量总和。在接收到的其他验证结果的数量达到预设数量，可以确定是否存在数据块对应的用户业务数据链，如果存在则直接上链，如果不存在则生成新的用户业务数据链。
请参阅图7，图7示意性示出了根据本公开的另一个实施例的数据处理方法的流程图。如图7所示，该数据处理方法包括：步骤S710～步骤S750。
步骤S710：响应于数据块，从业务信息校验值中解析出用户ID和业务ID；其中，数据块由目标控制器生成，目标控制器用于通过分布式账本共识机制验证数据块，并向中央编排器、各域编排器、各控制器广播数据块验证结果。
步骤S720：若用户ID与数据块中携带的用户ID一致，且业务ID与数据块中携带的业务ID一致，则判定验证通过；若用户ID与数据块中携带的用户ID不一致，或者，业务ID与数据块中携带的业务ID不一致，则判定验证不通过。
步骤S730：若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果。
步骤S740：将数据块保存在用户业务数据块仓库功能模块中。
步骤S750：当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
需要说明的是，步骤S710～步骤S750与图1所示的各步骤及其实施例相对应，针对步骤S710～步骤S750的具体实施例方式，请参阅图1所示的各步骤及其实施例，此处不再赘 述。
可见，实施图7所示的方法，可以对数据块中的业务信息校验值进行验证，并在验证通过后广播验证结果，当各验证结果的数量达到预设数量时，可以将数据块上链，在面对业务执行过程中出现故障的情况时，可以避免因管理域之间的不可信关系导致的故障溯源效率低和服务启用效率低的问题，即可以利用区块链技术的多点存储、不可篡改等特性，保证每次操作均可溯源，且操作记录无法被篡改，有利于提升故障溯源效率和服务启用效率。此外，还可以提升整体网络对恶意攻击和信息篡改的抵抗能力，进而提升不同管理域之间的信任。
请参阅图8，图8示意性示出了根据本公开的一个实施例的数据处理系统的结构图。
如图8所示，该数据处理系统800包括：
目标域编排器/目标控制器810，广播数据块；
其他控制器820，响应于数据块，对数据块中的业务信息校验值进行验证；若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
可见，实施图8所示的系统，可以对数据块中的业务信息校验值进行验证，并在验证通过后广播验证结果，当各验证结果的数量达到预设数量时，可以将数据块上链，在面对业务执行过程中出现故障的情况时，可以避免因管理域之间的不可信关系导致的故障溯源效率低和服务启用效率低的问题，即可以利用区块链技术的多点存储、不可篡改等特性，保证每次操作均可溯源，且操作记录无法被篡改，有利于提升故障溯源效率和服务启用效率。此外，还可以提升整体网络对恶意攻击和信息篡改的抵抗能力，进而提升不同管理域之间的信任。
请参阅图9，图9示意性示出了根据本公开的一个实施例中的数据处理装置的结构框图。数据处理装置900与图1所示的方法相对应，如图9所示，该数据处理装置900包括：
验证单元901，被配置为响应于数据块，对数据块中的业务信息校验值进行验证；
广播单元902，被配置为若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；
上链单元903，被配置为当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
可见，实施图9所示的装置，可以对数据块中的业务信息校验值进行验证，并在验证通过后广播验证结果，当各验证结果的数量达到预设数量时，可以将数据块上链，在面对业务执行过程中出现故障的情况时，可以避免因管理域之间的不可信关系导致的故障溯源效率低和服务启用效率低的问题，即可以利用区块链技术的多点存储、不可篡改等特性，保证每次操作均可溯源，且操作记录无法被篡改，有利于提升故障溯源效率和服务启用效率。此外，还可以提升整体网络对恶意攻击和信息篡改的抵抗能力，进而提升不同管理域之间的信任。
在本公开的一种示例性实施例中，验证单元901对数据块中的业务信息校验值进行验证，包括：
从业务信息校验值中解析出用户ID和业务ID；
若用户ID与数据块中携带的用户ID一致，且业务ID与数据块中携带的业务ID一致，则判定验证通过。
可见，实施该实施例，可以实现基于数据块的信息验证，从而有利于确认数据块的合法性。
在本公开的一种示例性实施例中，还包括：
判定单元，被配置为若用户ID与数据块中携带的用户ID不一致，或者，业务ID与数据块中携带的业务ID不一致，则判定验证不通过。
可见，实施该实施例，可以避免不合法数据被验证通过。
在本公开的一种示例性实施例中，还包括：
保存单元，被配置为将数据块保存在用户业务数据块仓库功能模块中。
可见，实施该实施例，可以丰富用户业务数据块仓库功能模块的功能种类，提升用户业务数据块仓库功能模块的能力。
在本公开的一种示例性实施例中，其中：数据块由目标控制器生成，目标控制器用于通过分布式账本共识机制验证数据块，并向中央编排器、各域编排器、各控制器广播数据块验证结果。
可见，实施该实施例，可以使得目标域编排器基于分布式账本共识机制使得在数据块验证后得以广播，并利用区块链技术将数据块上链，从而解决管理域之间难以信任的问题。
在本公开的一种示例性实施例中，其中：域编排器和控制器之间通过全网状连接方式进行连接；其中，全网状连接用于传递数据块。
可见，实施该实施例，可以使得域编排器和控制器之间可以直接传递数据块，从而有利于提升对于数据块的传递效率。
应当注意，尽管在上文详细描述中提及了被配置为动作执行的设备的若干模块或者单元，但是这种划分并非强制性的。实际上，根据本公开的实施方式，上文描述的两个或更多模块或者单元的特征和功能可以在一个模块或者单元中具体化。反之，上文描述的一个模块或者单元的特征和功能可以进一步划分为由多个模块或者单元来具体化。
请参阅图10，图10示出了适于用来实现本公开实施例的电子设备的计算机系统的结构示意图。
需要说明的是，图10示出的电子设备的计算机系统1000仅是一个示例，不应对本公开实施例的功能和使用范围带来任何限制。
如图10所示，计算机系统1000包括中央处理单元(CPU)1001，其可以根据存储在只读存储器(ROM)1002中的程序或者从储存部分1008加载到随机访问存储器(RAM)1003中的程序而执行各种适当的动作和处理。在RAM 1003中，还存储有系统操作所需的各种程序和数据。CPU 1001、ROM 1002以及RAM 1003通过总线1004彼此相连。输入/输出(I/O)接口1005也连接至总线1004。
以下部件连接至I/O接口1005：包括键盘、鼠标等的输入部分1006；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分1007；包括硬盘等的储存部分1008；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分1009。通信部分1009经由诸如因特网的网络执行通信处理。驱动器1010也根据需要连接至I/O接口1005。可拆卸介质1011，诸如磁盘、光盘、磁光盘、半导体存储器等等，根据需要安装在驱动器1010上，以便于从其上读出的计算机程序根据需要被安装入储存部分1008。
特别地，根据本公开的实施例，上述参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括承载在计算机可读介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分1009从网络上被下载和安装，和/或从可拆卸介质1011被安装。在该计算机程序被中央处理单元(CPU)1001执行时，执行本公开的方法和装置中限定的各种功能。
本公开的示例性实施方式还提供一种计算机程序产品。计算机程序产品包括计算机程序，计算机程序被处理器执行时实现上述数据处理方法。
在一种实施方式中，计算机程序产品可以是包含计算机程序的有形产品，如存储有计算机程序的计算机可读存储介质。可读存储介质可以是基于电、磁、光、电磁、红外线等信号的存储介质，包括但不限于：随机存取存储器(RAM)，只读存储器(ROM)，磁带，软盘，闪存(Flash)，机械硬盘(HDD)，固态硬盘(SSD)，等等。示例性的，计算机程 序产品可以实现为存储有计算机程序的非易失性存储介质，如只读存储器，与非门闪存(Nand Flash)等。
在一种实施方式中，计算机程序产品可以是包含计算机程序的无形产品。示例性的，计算机程序产品可以实现为虚拟数字产品，如存储有计算机程序的可执行文件，安装包等数字文件。
计算机程序的代码可以通过一种或多种程序设计语言来编写。程序设计语言如C语言、Java、C++等。程序代码可以完全地在用户计算设备上执行，或者部分地在用户计算设备上执行，或者作为一个独立的软件包执行，或者部分在用户计算设备上部分在远程计算设备上执行，或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，如局域网(LAN)、广域网(WAN)等，连接到用户计算设备，或者，可以连接到外部计算设备(例如通过运营商提供的因特网连接)。
计算机程序可以通过电、磁、光、电磁、红外线等信号承载或传输。电子设备可以将承载计算机程序的信号转换为数字信号，进而运行计算机程序。当计算机程序在电子设备上运行时，其代码被配置为使电子设备执行(更具体地，可以使电子设备的处理器执行)本公开各种示例性实施方式的方法步骤，如可以执行上述数据处理方法，其包括以下步骤：响应于数据块，对数据块中的业务信息校验值进行验证；若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；当接收到的其他验证结果的数量达到预设数量时，将数据块上链。
通过计算机程序执行上述方法步骤，可以对数据块中的业务信息校验值进行验证，并在验证通过后广播验证结果，当各验证结果的数量达到预设数量时，可以将数据块上链，在面对业务执行过程中出现故障的情况时，可以避免因管理域之间的不可信关系导致的故障溯源效率低和服务启用效率低的问题，即可以利用区块链技术的多点存储、不可篡改等特性，保证每次操作均可溯源，且操作记录无法被篡改，有利于提升故障溯源效率和服务启用效率。此外，还可以提升整体网络对恶意攻击和信息篡改的抵抗能力，进而提升不同管理域之间的信任。
附图中的流程图和框图，图示了按照本公开各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，上述模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图或流程图中的每个方框、以及框图或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本公开实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现，所描述的单元也可以设置在处理器中。其中，这些单元的名称在某种情况下并不构成对该单元本身的限定。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其它实施方案。本公开旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由权利要求指出。

Claims (10)

  1. 一种数据处理方法，包括：
    响应于数据块，对所述数据块中的业务信息校验值进行验证；
    若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；
    当接收到的其他验证结果的数量达到预设数量时，将所述数据块上链。
  2. 根据权利要求1所述的方法，其中，对所述数据块中的业务信息校验值进行验证，包括：
    从所述业务信息校验值中解析出用户ID和业务ID；
    若所述用户ID与所述数据块中携带的用户ID一致，且所述业务ID与所述数据块中携带的业务ID一致，则判定验证通过。
  3. 根据权利要求2所述的方法，其中，还包括：
    若所述用户ID与所述数据块中携带的用户ID不一致，或者，所述业务ID与所述数据块中携带的业务ID不一致，则判定验证不通过。
  4. 根据权利要求1所述的方法，其中，还包括：
    将所述数据块保存在用户业务数据块仓库功能模块中。
  5. 根据权利要求1所述的方法，其中，所述数据块由目标控制器生成，所述目标控制器用于通过分布式账本共识机制验证所述数据块，并向中央编排器、各域编排器、各控制器广播数据块验证结果。
  6. 根据权利要求1～5中任一项所述的方法，其中，所述域编排器和所述控制器之间通过全网状连接方式进行连接；其中，全网状连接用于传递所述数据块。
  7. 一种数据处理系统，包括：
    目标域编排器/目标控制器，广播数据块；
    其他控制器，响应于数据块，对所述数据块中的业务信息校验值进行验证；若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；当接收到的其他验证结果的数量达到预设数量时，将所述数据块上链。
  8. 一种数据处理装置，包括：
    验证单元，被配置为响应于数据块，对所述数据块中的业务信息校验值进行验证；
    广播单元，被配置为若验证通过，则广播本方验证结果，并接收各域编排器和各控制器广播的其他验证结果；
    上链单元，被配置为当接收到的其他验证结果的数量达到预设数量时，将所述数据块上链。
  9. 一种计算机程序产品，包括计算机程序，所述计算机程序被处理器执行时实现权利要求1至6任一项所述的方法。
  10. 一种电子设备，包括：
    处理器；以及
    存储器，被配置为存储所述处理器的可执行指令；
    其中，所述处理器配置为经由执行所述可执行指令来执行权利要求1-6任一项所述的方法。
PCT/CN2024/127860 2024-06-06 2024-10-28 数据处理方法、数据处理系统、装置 Pending WO2025251507A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202410733424.2 2024-06-06
CN202410733424.2A CN121098470A (zh) 2024-06-06 2024-06-06 数据处理方法、数据处理系统、装置

Publications (1)

Publication Number Publication Date
WO2025251507A1 true WO2025251507A1 (zh) 2025-12-11

Family

ID=97888717

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/127860 Pending WO2025251507A1 (zh) 2024-06-06 2024-10-28 数据处理方法、数据处理系统、装置

Country Status (2)

Country Link
CN (1) CN121098470A (zh)
WO (1) WO2025251507A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210055974A1 (en) * 2017-12-27 2021-02-25 Bull Sas Computer network of computing resource infrastructures and method for allocating said resources to client applications
WO2022027531A1 (zh) * 2020-08-03 2022-02-10 西安电子科技大学 区块链构建方法、系统、存储介质、计算机设备及应用
US20230036439A1 (en) * 2021-07-23 2023-02-02 International Business Machines Corporation Blockchain controlled cross-domain data transfer
WO2023098042A1 (zh) * 2021-12-01 2023-06-08 深圳前海微众银行股份有限公司 基于区块链的交易共识方法、装置、设备及存储介质
WO2024007689A1 (zh) * 2022-07-08 2024-01-11 腾讯科技（深圳）有限公司 共识网络的数据处理方法、装置、程序产品、设备和介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210055974A1 (en) * 2017-12-27 2021-02-25 Bull Sas Computer network of computing resource infrastructures and method for allocating said resources to client applications
WO2022027531A1 (zh) * 2020-08-03 2022-02-10 西安电子科技大学 区块链构建方法、系统、存储介质、计算机设备及应用
US20230036439A1 (en) * 2021-07-23 2023-02-02 International Business Machines Corporation Blockchain controlled cross-domain data transfer
WO2023098042A1 (zh) * 2021-12-01 2023-06-08 深圳前海微众银行股份有限公司 基于区块链的交易共识方法、装置、设备及存储介质
WO2024007689A1 (zh) * 2022-07-08 2024-01-11 腾讯科技（深圳）有限公司 共识网络的数据处理方法、装置、程序产品、设备和介质

Also Published As

Publication number Publication date
CN121098470A (zh) 2025-12-09

Similar Documents

Publication Publication Date Title
US11895104B2 (en) Service processing method and apparatus based on blockchain system, medium and electronic device
US10754989B2 (en) Runtime self-correction for blockchain ledgers
US12105735B2 (en) Asynchronous accounting method and apparatus for blockchain, medium and electronic device
US10379894B1 (en) Lineage-based trust for virtual machine images
US20200110905A1 (en) Security hardened software footprint in a computing environment
CN110880146A (zh) 区块链上链方法、装置、电子设备及存储介质
CN116846888A (zh) 区块链网络的共识处理方法、装置、设备及存储介质
US20250130735A1 (en) Data Processing Method and Related Device
WO2020232859A1 (zh) 分布式存储系统、数据写入方法、装置和存储介质
US20230224162A1 (en) Managing standard operating procedures using distributed ledger networks
WO2023040453A1 (zh) 一种交易信息处理方法及装置
CN117376364A (zh) 一种数据处理方法及相关设备
CN111489156A (zh) 基于区块链的交易方法、电子装置及可读存储介质
CN106487712A (zh) 用于接入多个外部系统的方法、装置及服务器
CN111475813A (zh) 一种可信虚拟化平台管理系统与方法
CN121193468A (zh) 一种面向企业级应用的安全部署方法、设备及介质
CN118713816B (zh) 服务器系统、固件处理方法、装置、设备、介质及产品
EP4567647A1 (en) Authorization identifiers with executable code blocks
US20200401561A1 (en) Method, device, and computer program product for managing data object
WO2025251507A1 (zh) 数据处理方法、数据处理系统、装置
CN110858211B (zh) 数据存储方法、装置及系统、存储介质
CN117171812A (zh) 基于区块链的多源可信数据生产方法、区块链节点及系统
CN113592645A (zh) 数据验证的方法和装置
CN119628969B (zh) 建筑项目管理方法、装置、电子设备及存储介质
US20260064461A1 (en) Method, device, and computer program product for determining job conflicts

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24942411

Country of ref document: EP

Kind code of ref document: A1