CN119885263A - Zero trust authority management blockchain certification storage method based on government affair data platform - Google Patents
Zero trust authority management blockchain certification storage method based on government affair data platform Download PDFInfo
- Publication number
- CN119885263A CN119885263A CN202411914954.3A CN202411914954A CN119885263A CN 119885263 A CN119885263 A CN 119885263A CN 202411914954 A CN202411914954 A CN 202411914954A CN 119885263 A CN119885263 A CN 119885263A
- Authority
- CN
- China
- Prior art keywords
- data
- user
- access
- trust
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Medical Informatics (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
Abstract
本发明公开一种基于政务数据平台的零信任权限管理区块链存证方法，具体包括以下步骤：S1：第一系统获取政务数据平台中的用户数据，对用户数据进行分类分级加密得到加密数据，将加密数据进行本地存储；S2：第一系统将加密数据上传到第二系统进行存储，得到对应的内容标识符和哈希值，作为标识索引；S3：第一系统将标识索引上传到区块链平台进行存储；S4：根据用户属性信息计算用户的即时信任值，并动态调整访问权限；S5：根据访问权限从区块链平台获取待访问内容的标识索引，进而从第二系统获取对应的加密数据。
The present invention discloses a zero-trust authority management blockchain evidence storage method based on a government data platform, which specifically includes the following steps: S1: a first system obtains user data in the government data platform, classifies and grades the user data to obtain encrypted data, and stores the encrypted data locally; S2: the first system uploads the encrypted data to a second system for storage, obtains a corresponding content identifier and a hash value as an identification index; S3: the first system uploads the identification index to a blockchain platform for storage; S4: calculates the user's instant trust value based on user attribute information, and dynamically adjusts access rights; S5: obtains the identification index of the content to be accessed from the blockchain platform based on the access rights, and then obtains the corresponding encrypted data from the second system.
Description
Technical Field
The invention relates to the technical field of blockchains, in particular to a zero trust authority management blockchain certification method based on a government affair data platform.
Background
With the advancement of informatization construction, more and more government data platforms are adopting digital technology to improve service quality, and government hotlines are taken as important channels for government to communicate with the public, and are responsible for the management work of a large amount of work order information. These work orders involve sensitive personal privacy data such as name, phone, user password, work order content, and call recordings. Currently, the data size stored by platforms has reached about 80TB, and the data volume is still increasing. How to realize efficient storage and management under the premise of ensuring the security of the sensitive data has become a main challenge facing the current technology.
In the prior art, data privacy protection and secure storage are typically implemented by encryption. Symmetric encryption algorithms (e.g., AES, DES, national encryption SM 4) and asymmetric encryption algorithms (e.g., RSA, ECC) do have certain advantages in preventing unauthorized access, and are commonly used to protect personal private data. However, the local storage mode in the current system has obvious defects, and even if some sensitive information (such as name, telephone and user password) is encrypted, core contents of the work order (such as complaints, report details and work order contents) and call records still do not take adequate encryption or protection measures.
In the above case, the work order content and the recorded data are still stored in plain text on the local server, and user privacy is at great risk of disclosure once the local storage is subject to unauthorized access or hacking. Furthermore, the lack of technical support of blockchains also causes the system to face other serious implications. Under the centralized local storage architecture, the tampering and deletion of the data are difficult to prevent, and particularly, high-authority users such as administrators can directly modify or delete the local data, so that the integrity and the authenticity of the data are not guaranteed. Due to the lack of tamper-resistant properties of the blockchain, the system cannot ensure the unalterability of the data, and there is no effective traceability mechanism to track the operation behavior of the data each time, which makes the system have a large vulnerability in terms of data security and transparency.
For example, the existing government service line has the following problems that firstly, although partial sensitive information (such as names, telephones and passwords) is encrypted, the privacy protection of work order contents and records is insufficient, especially, complaints and report data are not fully encrypted, and the risk of privacy disclosure exists, secondly, the risk of data tampering is that the sensitive data of the government service line has the potential risk of being tampered or deleted, the existing storage scheme lacks effective tamper resistance and traceability, once the data is tampered or deleted, the traceability mechanism is lacking to confirm responsible parties, thirdly, the limitation of centralized storage is that the traditional centralized architecture of the storage system has the risk of single point failure, the requirement of large-scale data storage cannot be met, the redundancy backup mechanism is lacking, and fourthly, the data operation record is lacking, in the existing scheme, the operations such as access and modification of the work order data lack effective record and audit mechanism, and the transparency and traceability of operation behavior are difficult to realize.
In summary, how to realize safer, transparent and efficient data storage and management becomes an urgent problem to be solved by the current government hot line system. By combining the blockchain and the distributed storage technology, the problems of privacy protection, data tampering and the like in the prior art are hopeful to be solved, and the expandability and the operation efficiency of the system are improved.
Disclosure of Invention
Aiming at the problems of lower government affair data storage security and poorer traceability in the prior art, the invention provides a zero trust authority management blockchain certification method based on a government affair data platform.
In order to achieve the above object, the present invention provides the following technical solutions:
a zero trust authority management blockchain certification method based on a government affair data platform specifically comprises the following steps:
S1, a first system acquires user data in a government affair data platform, classifies and encrypts the user data to obtain encrypted data, and locally stores the encrypted data;
s2, the first system uploads the encrypted data to the second system for storage to obtain a corresponding content identifier and a hash value as an identification index;
s3, the first system uploads the identification index to the blockchain platform for storage;
S4, calculating an instant trust value of the user according to the user attribute information, and dynamically adjusting the access right;
S5, acquiring an identification index of the content to be accessed from the blockchain platform according to the access authority, and further acquiring corresponding encrypted data from the second system.
Preferably, the S1 includes:
S1-1, a first system acquires user data in a government affair data platform and classifies the user data;
S1-2, preprocessing data of different categories to obtain a data block;
S1-3, the first system adopts SM4 cryptographic algorithm to generate secret key, and adopts CBC cryptographic mode to randomly generate initialization vector IV.
S1-4, encrypting the Data blocks block by using a secret key to obtain an Encrypted result;
S1-5, splicing the Encrypted Data and the IV into Encrypted Payload, namely Encrypted Data.
Preferably, the S2 includes:
S2-1, the first system packs the encrypted data and uploads the packed encrypted data to the second system, and the second system generates a corresponding CID for each encrypted data and returns the CID to the first system;
s2-2, the first system calculates a corresponding hash value of the encrypted data;
S2-3, the first system takes the hash value and the CID returned by the second system as an identification Index of the user data.
Preferably, the step S3 further includes:
And recording an operation log of user data each time, and uploading and verifying the hash value of the operation log, wherein the operation log comprises operation time, operator identity and operation type.
Preferably, the S4 further includes:
S4-1, acquiring user attribute information, wherein the user attribute information comprises a user Identity (ID), a position, a department, an access device and an access position;
S4-2, calculating an instant trust value T k (U) of the user k according to the current user attribute information:
Tk(U)＝w1·Tk'(U)+w2·Rk+w3·Ak (1)
In the formula (1), T k (U) represents an instant trust value of a user k, T k' (U) represents a historical trust value of the user k, R k represents a recommended trust value of other users on the user k, A k represents a trust value related to a user attribute, w 1 represents a weight coefficient of the historical trust value, w 2 represents a weight coefficient of the recommended trust value, and w 3 represents a weight coefficient of the user attribute trust value;
S4-3, if the instant trust value T k (U) is larger than or equal to a first preset threshold value T 1, allowing the user to normally access, and if the instant trust value is smaller than the first preset threshold value T 1, triggering additional identity verification or reducing access authority level;
And S4-4, dynamically adjusting the access authority of the user according to the instant trust value.
Preferably, in S4-4, the access right includes:
The first access right, namely accessing all allowed data contents when the instant trust value T k (U) is larger than or equal to a first preset threshold value T 1;
The second access right, when the second preset threshold T 2<Tk(U)<T1, limits the access right of the user, wherein the limit comprises only readable data, and the modification or deletion is forbidden;
And third access authority, namely rejecting the access request of the user when the trust value is smaller than a second preset threshold T 2.
Preferably, the method also comprises the step S4-5 of verifying and auditing the access authority of the user based on the forced access control (MAC) mechanism, and the specific steps comprise:
The system distributes the operation authority of the user according to the Bell-LaPadula model rule according to the security level label S (U) of the user and the security level label S (D) of the data;
And B, automatically performing authority verification and auditing according to a preset threshold and a security policy, returning an identification index to the user if the approval passes, and refusing access and notifying the user if the approval passes.
Preferably, the method for distributing the operation authority of the user comprises the following steps:
The simple security rule is that the user can only read the data below the security level, namely, for the user U i and the data D j, the condition of the reading operation is that S (U i)>S(Dj);S(Ui) represents the security level label of the user U i;
No rule is written-the user can only write to data above or equal to his security level, i.e. S (U i)≤S(Dj).
Preferably, the S5 includes:
S5-1, firstly, a second system acquires a worker Shan Haxi value and a corresponding CID which are stored on a block chain through the block chain;
s5-2, the first system acquires the encrypted data from the second system according to the I Shan Haxi value and the corresponding CID, and sends the encrypted data to the user.
Preferably, in S5-2,
The first system recalculates the verification hash value of the encrypted data obtained from the second system and compares the verification hash value with the worker Shan Haxi value stored on the blockchain, if the verification hash value is consistent, the first system sends the ciphertext data to the user if the verification hash value is consistent, and if the verification hash value is not matched, the first system gives a warning and marks the data as potential tampering.
In summary, due to the adoption of the technical scheme, compared with the prior art, the invention has at least the following beneficial effects:
the invention encrypts the sensitive information (including work order content and recording) of all users through the SM4 encryption, and the sensitive information is encrypted and protected in storage and transmission, thereby ensuring that the data privacy is not revealed even in a distributed network.
The non-tamperable nature of the blockchain of the present invention ensures that the encrypted data and operational records stored in IPFS cannot be tampered with or deleted, any tampering being verified by the hash value stored on the chain.
The IPFS distributed storage solves the bottleneck problem of large-scale data storage, avoids single-point fault risks of traditional centralized storage, provides a redundant storage mechanism, and ensures long-term effectiveness and accessibility of data.
The invention can record and link the operation behaviors such as accessing, modifying, downloading and the like of the work order data in detail each time, ensures the transparency of the operation process and is beneficial to audit and tracing.
The system can adapt to the ever-increasing government hot line data storage requirements by combining IPFS and the characteristics of the blockchain, and ensures that the system still keeps high-efficiency and reliable operation under high load in the future.
Drawings
Fig. 1 is a schematic diagram of a zero trust authority management blockchain certification method based on a government data platform according to an exemplary embodiment of the invention.
Detailed Description
The present invention will be described in further detail with reference to examples and embodiments. It should not be construed that the scope of the above subject matter of the present invention is limited to the following embodiments, and all techniques realized based on the present invention are within the scope of the present invention.
In the description of the present invention, it should be understood that the terms "longitudinal," "transverse," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," and the like indicate orientations or positional relationships based on the orientation or positional relationships shown in the drawings, merely to facilitate describing the present invention and simplify the description, and do not indicate or imply that the devices or elements referred to must have a specific orientation, be configured and operated in a specific orientation, and therefore should not be construed as limiting the present invention.
The encryption and storage management of data by the current government system mainly depends on the traditional centralized method, and although the security of sensitive data can be ensured to a certain extent, the methods obviously cannot completely meet the requirements of privacy protection and efficient storage along with the increase of the data volume and the change of storage requirements. In particular, in terms of tamper protection, transparency auditing, and distributed storage of data, there are significant shortcomings with existing techniques and architectures.
As shown in fig. 1, the invention provides a zero trust authority management blockchain certification method based on a government affair data platform, which specifically comprises the following steps:
S1, a first system acquires user data in a government affair data platform, classifies and encrypts the user data to obtain encrypted data, and locally stores the encrypted data.
In this embodiment, a user submits user data through a government hot line, where the user data includes a name, a telephone, a user password, worksheet contents (such as complaints, reports, etc.), and call records.
In this embodiment, after receiving the user data, the system firstly performs local encryption processing on the sensitive information of the user, for example, an SM4 symmetric encryption algorithm may be adopted to ensure that the sensitive data cannot be read by an external visitor without decryption. The encrypted data will be stored locally for later processing, ensuring that it is not compromised during transmission and storage.
S1-1, a first system acquires user data in a government affair data platform and classifies the user data.
In the embodiment, the method for classifying, grading and encrypting the user data information is characterized in that the user data information is classified into different categories according to the sensitivity and the importance of the user data information, and the corresponding use permission is defined.
S1-1-1 in the present embodiment, the first system automatically classifies the user data into the following categories based on the nature and purpose of the content of the user data information:
Personal identity information class including information capable of directly identifying personal identity such as name, identification card number, telephone number, address, etc.;
the worksheet content class comprises business information such as complaint content, advice content, consultation content and the like;
The multimedia record class comprises audio and video data such as call records, picture accessories and the like;
The operation log class comprises user access records, operation time, IP addresses and other system logs;
Statistical analysis class including summary data such as job ticket processing statistics, satisfaction ratings, etc.
And S1-1-2, the first system automatically divides the data of each category into four security levels according to the sensitivity, namely, firstly, the first system sets a keyword library and a weight coefficient, then, defines a level coefficient for the category of the data, and calculates the security level of the data in the government platform according to the keywords contained in the data and the category of the data to which the data belongs. Specifically:
① The keyword library and the weight coefficient are defined in the following table 1:
TABLE 1 keyword library and weight coefficient definition
| Keyword library | Keyword(s) | Weight coefficient (0 to 1) |
| Privacy identification word stock | Identity card, bank card, password. | 1.0 |
| Sensitive word stock | Complaints, reports, violations. | 0.8 |
| Business word stock | Advice, consultation, query. | 0.4 |
② Defining class coefficients (0-1) of data types, such as personal identity information class 1.0, work order content class 0.8, multimedia record class 0.6, operation log class 0.4 and statistical analysis class 0.2;
③ The system divides the data into 4 security levels, calculates the security level score of the data, and corresponds it to different levels. As shown in table 2:
Security class score = MAX (keyword weight coefficient 0.6+ data class coefficient 0.4)
TABLE 2 Security level score List
| Security level | Description of the invention | Security grade score (0 to 1) |
| Core Level (Level-1) | Data directly related to personal privacy and having unique identification | [0.9,1.0] |
| Sensitive Level (Level-2) | Indirectly related to personal privacy or data containing sensitive business information | [0.7,0.9) |
| Inner stage (Level-3) | Data for internal use only but without sensitive information | [0.5,0.7) |
| Disclosure Level (Level-4) | Statistics type information capable of being externally disclosed | [0,0.5) |
For example, a piece of work order content containing "identity card" keywords, firstly the keyword class weight coefficient=1.0 (the weight of the identity card), secondly the data class weight coefficient=0.8 (the work order content class), so that the data security class score is 1.0×0.6+0.8×0.4=0.92, and finally the security class of the data is the core class (Level-1).
S1-1-3, authority allocation rule:
1) Data access rights:
Level-1 data, namely only core management personnel can access the data completely, and related business personnel can access the desensitized information;
Level-2 data, which is completely accessible above the department administration Level and is accessible to common operators for necessary fields;
level-3 data, accessible to all officials, but requiring access logs to be recorded;
level-4 data, accessible to all users without special authorization.
2) Data operation authority:
read rights-user can access data not higher than its own security level;
modifying rights-user can modify data equal to self security level;
delete rights-only users above the data security level are allowed to perform delete operations.
S1-2, preprocessing different types of data to obtain data blocks, namely converting the data blocks into JSON format (text) which is convenient for unified encryption, and then partitioning the JSON format data according to the packet size (16 bytes) of an SM4 algorithm to obtain the data blocks.
In this embodiment, data of different types are put into a dictionary, and then converted into JSON format (text), so that unified encryption is facilitated.
S1-3, the first system adopts SM4 national encryption algorithm to generate a 128-bit (16-byte) key, the 128-bit key is used for encryption and decryption processes, and adopts CBC encryption mode to randomly generate a 16-byte initialization vector IV.
S1-4, encrypting the Data blocks block by using the key in S1-3 (belonging to the prior art) to obtain an Encrypted result;
S1-5, splicing the Encrypted result encrypted_data and the IV (namely IV+encrypted_data) into encrypted_payload, namely Encrypted Data, and transmitting the Encrypted Data to a local system (a first system) for storage.
And S2, the first system uploads the encrypted data to IPFS (the second system) for storage, and a corresponding content identifier and a hash value are obtained and used as a unique identification Index of the user data.
In this embodiment, the first system uploads IPFS (interstellar file system) the encrypted data to realize distributed storage of the data.
S2-1, the first system packages the encrypted data and uploads the packaged encrypted data to the second system, and the second system generates a unique Content Identifier (CID) for each encrypted data, wherein the CID is used for identifying the encrypted data stored in IPFS and returning the encrypted data to the first system.
S2-2 to ensure subsequent data verification, the first system computes a hash value for the encrypted data (e.g., SHA-256 algorithm, which is prior art and therefore not repeated here). The hash value ensures that the data integrity can be verified in any subsequent operation.
S2-3, the first system records the hash value and CID returned by the second system as unique identification Index of the user data for subsequent block chain uplink certification.
And S3, the first system uploads the identification index to the blockchain platform for storage.
In this embodiment, the blockchain platform may guarantee the non-tamper-resistance and operational transparency of the data through smart contracts.
In this embodiment, the second system uploads the hash value and CID (identification index) of the encrypted data to the blockchain, and stores the hash value and CID on the chain by the data-logging intelligence contract. The hash value ensures the uniqueness and integrity of the encrypted data, and the CID is used to point to specific encrypted data stored in the second system. Once the data is uplinked, the data cannot be tampered, and the authenticity and durability of the stored data are ensured through the non-tamperable characteristic of the blockchain.
And simultaneously recording the operation log of the work order data each time, and uploading and verifying the hash value of the operation log. Each time an operation log (such as operation time, operator identity, operation type, etc.) generates a corresponding hash value and stores the hash value in the blockchain, ensuring the transparency and auditability of each operation behavior.
S4, in order to ensure the system security and the compliance of data access, in the embodiment, the first system adopts trust evaluation of a zero trust architecture and authority verification based on a Mandatory Access Control (MAC) mechanism. When a user accesses, modifies or deletes data, the first system firstly extracts user attribute information (such as positions, departments, access equipment and positions) through identity recognition, calculates a real-time trust value T (U) of the user, and dynamically adjusts access rights. Users whose trust value reaches a threshold may access the corresponding data content by rights, otherwise additional authentication or rights restrictions will be triggered. Meanwhile, the first system further checks security level labels of the user and the data through the MAC model, ensures that the user can only read the data within the authority range of the user, and triggers the auditing committee to approve the high-sensitivity operation. All operations (accessing, modifying or deleting data, calculating trust value, adjusting access authority, checking security level labels and the like) generate logs, and the uncountable change and the whole traceability of data access are realized through hash values and IPFS CID uplink certificates for audit use.
S4-1, acquiring user attribute information, including user Identity (ID), positions (such as manager, department manager, common staff, etc.), departments, access devices, access positions, etc.;
S4-2, calculating an instant trust value T k (U) of the user k according to the current user attribute information, wherein T' k (U) represents a historical trust value, R k represents a recommended trust value of other users on the user k, and A k represents a trust value related to the user attribute.
Tk(U)＝w1·Tk'(U)+w2·Rk+w3·Ak (1)
In the formula (1), T k (U) represents an instant trust value of a user k, T k' (U) represents a historical trust value of the user k, R k represents a recommended trust value of other users on the user k, A k represents a trust value related to a user attribute, w 1 represents a weight coefficient of the historical trust value, w 2 represents a weight coefficient of the recommended trust value, and w 3 represents a weight coefficient of the trust value of the user attribute.
S4-3, if the instant trust value T k (U) is larger than or equal to the first preset threshold value T 1, the user is allowed to normally access, and if the instant trust value is smaller than the first preset threshold value T 1, additional identity verification is triggered or the access authority level is lowered.
And S4-4, dynamically adjusting the access authority of the user according to the instant trust value.
First access rights when the instant trust value T k (U) is greater than or equal to the first preset threshold T 1, all allowed data content is accessible to the user.
And the second access authority, namely when the instant trust value T k (U) is in a medium range, namely a second preset threshold T 2<Tk(U)<T1, limiting the user authority, wherein the limitation comprises only reading data and prohibiting modification or deletion.
And third access authority, namely when the trust value is smaller than a second preset threshold T 2, rejecting the access request of the user by the system.
In this embodiment, based on identity recognition and instant trust value calculation, a forced access control MAC mechanism is adopted to further verify and audit the access rights of the user, and the specific steps include:
and A, the system distributes the operation authority of the user according to the Bell-LaPadula model rule according to the security level label S (U) of the user and the security level label S (D) of the data. The user can only read the data below the access authority level and write the data above the authority level, so that the confidentiality of the data is ensured not to be violated.
In this embodiment, the method for generating the user security level tag S (U) includes:
1) Evaluating based on three dimensions of the user position level V, the department sensitivity D and the working life T;
2) The user security level calculation formula is S (U) =k 1·V+k2·D+k3 ·t, where k 1、k2、k3 is a weight coefficient and k 1+k2+k3 =1.
In this embodiment, generation of the data security level tag S (D):
1) Evaluating based on three dimensions of data type sensitivity C, data influence range R and timeliness E;
2) Data security level calculation formula S (D) =t 1·C+t2·R+t3 ·e, where t 1、t2、t3 is a weight coefficient and t 1+t2+t3 =1.
Finally, the system automatically maps the scores to different security levels (L1-L4) according to the calculation result.
In this embodiment, the operation authority allocation rule:
A simple security rule that a user can only read data below the security level thereof, namely, for the user U i and the data D j, the condition of the read operation is S (U i)>S(Dj);
No rule is written-the user can only write to data above or equal to his security level, i.e. S (U i)≤S(Dj).
And B, the system distributes the operation authority of the user according to the Bell-LaPadula model rule, automatically distributes the operation authority of the user based on the security level label, and sets a rule engine to automatically verify and audit the authority according to a preset threshold and a security policy. The auditing flow ensures the legitimacy and safety of the user request and prevents unauthorized operation. If the verification is passed, the unique identification (CID and hash value) of the data is returned to the user, and if the verification is not passed, the system refuses to access and informs the user.
Recording user access, modification, deletion, and other operational actions on data using an operational certification contract includes user initiation of an operational request, such as access, modification, deletion, and the like. Each user operation generates a detailed operation log including a user ID, a trust value T (U), requested access data, operation time, operation type, operation result, audit result, etc. And (3) uploading the hash value of the operation log to a certificate, so that all access operations are guaranteed to be unsmoothly changed and traceable.
S5, when an authorized user (such as an administrator or an operator) needs to access a certain work order, the system executes the following flow to ensure the integrity and the security of data:
S5-1, firstly, retrieving a worker Shan Haxi value and a CID from a blockchain, and acquiring a worker Shan Haxi value and a corresponding CID stored on the blockchain by a second system through the blockchain, wherein the CID is used for retrieving encrypted data from the second system;
And S5-2, the first system acquires the encrypted data from the second system and sends the encrypted data to the user, namely, the first system downloads the encrypted data from the second system through the CID, and the CID can uniquely identify and retrieve the corresponding data no matter which node the data is stored on due to the distributed storage characteristic of the second system.
In addition, data integrity verification may be performed, with the first system recomputing the hash value for the encrypted data retrieved from the second system and comparing it to the original hash value stored on the blockchain. If the hash values are consistent, indicating that the data has not been tampered with, the first system sends ciphertext data to the user, and if the hash values do not match, the first system will issue a warning and mark the data as potential tampering.
And if the hash verification is passed, the first system sends the encrypted data to the user. The user uses the corresponding key (128 bit key in S1-3) to decrypt the work order content and the sound recording and view the specific data content. The whole process ensures the integrity and the safety of the data and avoids the risks of tampering and leakage.
In this embodiment, when a user needs to perform operations such as accessing/modifying/deleting stored data information, a zero-trust architecture trust evaluation module is used to perform user identification, access right control and continuous trust evaluation, so that only authenticated legal users can access data resources and only authorized resources are ensured, in addition, the credibility of the users is evaluated in real time, and the access right is dynamically adjusted according to the evaluation result. And finally, the user operation log is logged in and stored for verification, so that the traceability audit is facilitated.
It will be understood by those of ordinary skill in the art that the foregoing embodiments are specific examples of carrying out the invention and that various changes in form and details may be made therein without departing from the spirit and scope of the invention.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411914954.3A CN119885263B (en) | 2024-12-24 | A zero-trust authority management blockchain evidence storage method based on government data platform |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411914954.3A CN119885263B (en) | 2024-12-24 | A zero-trust authority management blockchain evidence storage method based on government data platform |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN119885263A true CN119885263A (en) | 2025-04-25 |
| CN119885263B CN119885263B (en) | 2025-10-10 |
Family
ID=
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180005235A1 (en) * | 2016-06-29 | 2018-01-04 | Ca, Inc. | Electronic transaction risk assessment based on digital identifier trust evaluation |
| CN110113148A (en) * | 2019-04-28 | 2019-08-09 | 武汉理工大学 | A blockchain-based software-defined opportunistic network node authentication method |
| CN114553437A (en) * | 2022-03-02 | 2022-05-27 | 安徽师范大学 | Authorization verification method based on medical block chain |
| CN116805078A (en) * | 2023-06-14 | 2023-09-26 | 深圳市易联锋达科技有限公司 | A data intelligent management system and method for logistics information platform based on big data |
| CN117335960A (en) * | 2023-11-02 | 2024-01-02 | 北京邮电大学 | A blockchain-based carbon data sharing access method and device in a zero-trust network |
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180005235A1 (en) * | 2016-06-29 | 2018-01-04 | Ca, Inc. | Electronic transaction risk assessment based on digital identifier trust evaluation |
| CN110113148A (en) * | 2019-04-28 | 2019-08-09 | 武汉理工大学 | A blockchain-based software-defined opportunistic network node authentication method |
| CN114553437A (en) * | 2022-03-02 | 2022-05-27 | 安徽师范大学 | Authorization verification method based on medical block chain |
| CN116805078A (en) * | 2023-06-14 | 2023-09-26 | 深圳市易联锋达科技有限公司 | A data intelligent management system and method for logistics information platform based on big data |
| CN117335960A (en) * | 2023-11-02 | 2024-01-02 | 北京邮电大学 | A blockchain-based carbon data sharing access method and device in a zero-trust network |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Kissel | Glossary of key information security terms | |
| CN109040012A (en) | A kind of data security protecting and sharing method based on block chain and system and application | |
| CN116723042B (en) | Data packet security protection method and system | |
| CN110995657A (en) | Data access method, server and system based on data label | |
| CN119004426B (en) | Multi-dimension factor safety management system for government affair files | |
| CN112685790A (en) | Block chain data security and privacy protection method | |
| Doshi et al. | A review paper on security concerns in cloud computing and proposed security models | |
| CN113962787A (en) | Safety protection method for financial information | |
| CN120017424B (en) | A method and system for secure access to encrypted enterprise network data | |
| CN118381635A (en) | A cross-domain identity authentication method and system based on blockchain | |
| CN117034350A (en) | Data security protection method and device, computer equipment and storage medium | |
| CN114881469A (en) | Performance assessment and management system and method for enterprise workers | |
| CN116992500A (en) | Data double-layer storage data searching prevention method and system | |
| Li et al. | A secure and efficient log storage and query framework based on blockchain | |
| US20200285768A1 (en) | Method for determining and displaying the security state of data | |
| CN116232704A (en) | Data controlled access method and system based on XACML and intelligent contract | |
| CN111797382A (en) | A privilege control management method for privileged accounts | |
| CN119885263B (en) | A zero-trust authority management blockchain evidence storage method based on government data platform | |
| CN119442272A (en) | Customer information intelligent management platform and method based on cloud computing | |
| CN110516469B (en) | Anti-hacking method in shared big data application scene based on block chain | |
| CN119885263A (en) | Zero trust authority management blockchain certification storage method based on government affair data platform | |
| CN118611899A (en) | Security protection method and device for customer service management system | |
| Lakhno et al. | Analysis of information flows of distance education systems, taking into account the need to ensure their cybersecurity | |
| CN112769784A (en) | Text processing method and device, computer readable storage medium and processor | |
| CN118551412B (en) | A method for real-time dynamic processing of structured data security identification |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |