Data space system and connector assembly and data circulation method thereof

Abstract

The invention relates to the technical field of enterprise data security exchange, and particularly discloses a data space system and a connector assembly and a data circulation method thereof. The system comprises: a data space platform providing enterprise registration, purchase and registration of a connector assembly, issuing and transaction functions of a data product, and issuing a signed electronic transaction contract; the at least two connector assemblies are deployed in the corresponding enterprise intranet and have public network access addresses, and the zero-trust gateway controls the access permission granularity of a network port of the deployment equipment based on a dynamic strategy; the network agent module receives a data request of a user, performs asymmetric encryption processing on request data, and initiates a validity verification request to the connector service module through the Socket communication interface; the connector service module performs validity verification on the validity verification request based on the transaction evidence and the electronic contract information and returns a result; the method has the advantages of solving the data island phenomenon, improving the safety protection capability and reducing the deployment operation and maintenance complexity.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of enterprise data security exchange, in particular to a data space system and a connector component and data flow method thereof. BACKGROUND

[0002] In the current era of rapid development of digital economy, data has become one of the most critical assets for enterprises, and is also an important part of the core competitiveness of enterprises. With the accelerated promotion of digital transformation in various industries, the demand for data sharing and exchange between different organizations is growing. Especially in many fields such as finance, medicine, manufacturing, and supply chain, the role of cross-institutional data flow is becoming more and more significant. It not only greatly improves the efficiency of business cooperation, making cooperation between institutions more smooth and efficient, but also provides rich data support for promoting artificial intelligence modeling, making the model more accurate and reliable, and thus helping enterprises to make accurate decisions and occupy an advantage in the fierce market competition. Under this background, it is particularly important to build an efficient data space system and its connector component and data flow method.

[0003] However, enterprises currently face many serious technical and security challenges when conducting data flow.

[0004] The phenomenon of data silos seriously hinders the smooth flow of data. The data formats, interface protocols, and storage methods used by each enterprise are different, and there is a lack of unified standards and specifications, which makes it difficult for different systems to efficiently interface. The traditional solution is usually to modify the existing system or develop customized interfaces for enterprises, but this approach is costly and has poor flexibility, making it difficult to adapt to rapidly changing business needs.

[0005] Insufficient security protection is another major problem faced by data flow. Traditional data flow methods, such as using a centralized platform for transit or directly exposing API interfaces, not only have single point of failure risks, but also are vulnerable to man-in-the-middle attacks, and data security is severely threatened. Especially when dealing with highly sensitive information such as financial transaction records and medical health data, existing technologies are difficult to meet a series of strict security requirements such as fine-grained access control, end-to-end encrypted transmission, and complete transaction evidence. Even if some solutions use VPN or other encrypted channels, due to the lack of dynamic verification mechanisms, they cannot effectively prevent internal threats and credential theft risks, and data security risks still exist.

[0006] The lack of trust mechanisms also brings many troubles to data circulation. In the absence of a trusted third party, it is difficult for both parties to data transaction to accurately verify the authenticity of the other party's identity, and the execution of the contract terms also lacks automated protection. Most existing platforms require data copies to be transferred, which not only greatly increases the risk of data leakage, but also cannot ensure that the use of data fully complies with the contract agreement. In addition, once a transaction dispute arises, the handling process often relies on human intervention and lacks a complete digital chain of evidence, resulting in high costs for rights protection and seriously affecting the enthusiasm of enterprises to participate in data transactions.

[0007] The high complexity of deployment and operation is also a problem that cannot be ignored. Existing data circulation solutions usually require enterprises to deploy dedicated hardware gateways or complex middleware, and require professional teams to maintain security policies continuously. This high threshold configuration makes it difficult for small and medium-sized enterprises to effectively participate in the data circulation ecosystem due to technical and cost constraints, thereby restricting the healthy development of the data factor market.

[0008] In summary, in view of the above problems, the existing technology needs to be improved to meet the urgent needs of enterprises for data circulation in the digital economy era. Therefore, the present application proposes a data space system and its connector assembly and data circulation method. SUMMARY

[0009] The present application provides a data space system and its connector assembly and data circulation method, which has the advantages of solving the data island phenomenon, improving the security protection capability, and reducing the deployment and operation complexity.

[0010] The present application provides a data space system, comprising: a data space platform for providing enterprise registration, purchase and registration of connector assemblies, release and transaction functions of data products, and issuing signed electronic transaction contracts to the connector assemblies of the buyer and seller; at least two connector assemblies, each connector assembly being deployed in the corresponding enterprise intranet and having a public network access address, and comprising a zero-trust gateway, a network proxy module and a connector service module; the zero-trust gateway is used to control the access permission granularity of the network port of the deployment device based on dynamic strategy, wherein the dynamic strategy generates an adaptive control framework based on a dynamic risk map by fusing identity authentication results, device state detection data and real-time behavior analysis data; the network proxy module is used to receive a data request of a user, perform asymmetric encryption processing on the requested data, and initiate an effectiveness verification request to the connector service module through a Socket communication interface; A connector service module is configured to interact with the data space platform to obtain and store transaction records and electronic contract information, and perform legality verification on validity verification requests based on the transaction records and the electronic contract information and return results, wherein the legality verification adopts a deep fusion verification mechanism of contract terms and business context information.

[0011] Preferably, the zero-trust gateway comprises: A transaction scenario profiling submodule is configured to obtain user identity credentials based on the identity authentication result, obtain a terminal device security baseline in a scenario of a current data transaction process based on device state detection data, and analyze a deviation rate of a request frequency from a historical request frequency average, a matching degree of an actual data transmission volume and a contract agreed data transmission volume, and a geographical distance weight of a terminal IP and a business registration location as scenario-based risk factors based on real-time behavior analysis data. A correlation risk identification submodule is configured to identify a risk correlation relationship among the user identity credentials, the terminal device security baseline, and the network behavior features. A risk transmission analysis submodule is configured to map the user identity credentials, the terminal device security baseline, and the network behavior features into a dynamic risk graph based on the risk correlation relationship, identify all risk transmission paths of each scenario-based risk factor in the dynamic risk graph, and quantify a transmission influence weight of each scenario-based risk factor on each corresponding risk transmission path. An intelligent policy iteration submodule is configured to adjust an access permission granularity of a network port of a device based on the transmission influence weights of all scenario-based risk factors on all corresponding risk transmission paths.

[0012] Preferably, a public network access address of the connector component is implemented through NAT penetration or reverse proxy technology.

[0013] Preferably, the asymmetric encryption processing adopts an RSA algorithm or an ECC algorithm. The Socket communication interface is a long connection interface based on a TCP protocol, and supports real-time interaction between the network proxy module and the connector service module.

[0014] Preferably, the transaction records recorded by the connector service module include a transaction timestamp, identity information of both parties of a transaction, data product metadata, an electronic contract hash value, and an access log of the network proxy module.

[0015] Preferably, the process of the legality verification of the connector service module comprises: All contract terms in the electronic contract information are parsed into an executable business rule library, and all constraint items and corresponding associated conditions of each executable business rule in the executable business rule library are determined. Based on the request parameters and business context information of the validity verification request and the historical behavior characteristics in the transaction record, the real business intention of the user is identified; Based on the real business intention of the user, all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and the transaction record, the validity verification request is legally checked and the result is returned.

[0016] Preferably, based on the real business intention of the user, all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and the transaction record, the validity verification request is legally checked, including: A current intention vector is generated based on the real business intention of the user, and a legal intention vector library is determined based on electronic contract information; Based on the cosine similarity of the current intention vector and all legal intention vectors in the legal intention vector library, an intention matching degree is obtained; An executable business rule matrix is generated based on all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and a transaction behavior matrix is constructed based on the same matrix and the transaction record; The matching degree of the executable business rule matrix and the transaction behavior matrix is calculated as the transaction behavior legality degree; Based on the intention matching degree and the transaction behavior legality degree, a legality verification score is calculated.

[0017] The application provides a connector component of a data space system, comprising: A zero-trust gateway is deployed at the boundary of an enterprise intranet and is configured with a dynamic policy engine for generating access control policies based on user identity legality, terminal device security state and real-time operation behavior, and performing network port access control; A network proxy module is in communication connection with the zero-trust gateway, configured to receive external data requests, process the request data using an asymmetric encryption algorithm, and send verification instructions to the connector service module through Socket communication; The connector service module is in communication connection with the network proxy module and the data space platform, and is configured to obtain and store electronic contract information and transaction record data from the data space platform, perform legality verification on the verification instructions based on the electronic contract information and return the result, trigger the establishment of a point-to-point data transmission channel between the proxy module and the target connector component after verification, and record the access log of the data request.

[0018] Preferably, the point-to-point data transmission channel is implemented using TCP direct connection technology, and dynamic key rotation is performed during transmission; the transaction record data includes contract hash value, data product metadata and access log.

[0019] The application provides a data flow method of a data space system, comprising: The connector component deployed in the local intranet completes the registration process of the enterprise user on the data space platform, and binds the connector component with the enterprise identity; The data space platform publishes the seller data product and associates it to the seller connector component, and after receiving the target data product selection instruction input by the buyer, the platform receives the electronic contract signing result of both parties; The data space platform issues the signed transaction contract to the connector components of both the buyer and the seller, and the contract information is synchronously stored in the connector service modules of both parties; The network agent module of the buyer's local connector component initiates a data request, and after encrypting the requested data based on the network agent module, sends a verification request to the local connector service module through Socket communication; The connector service module checks the legality of the verification request based on the pre-stored electronic contract information, and returns a permission instruction if the verification is passed; When it is monitored that the network agent module receives the permission instruction, a point-to-point encrypted transmission channel is established between the connector component of the buyer and the connector component of the seller, the data product transmission is completed through the point-to-point encrypted transmission channel, and at the same time, the transaction timestamp, data product metadata and access log are recorded by the connector service modules of both parties as transaction evidence.

[0020] The beneficial effects of this invention compared to existing technologies are as follows: The data space platform provides functions for enterprise registration, registration of the sale and purchase of connector components, and release and trading of data products. It can also issue signed electronic transaction contracts to both buyers and sellers of connector components, constructing a complete data trading ecosystem and promoting data flow and cooperation among enterprises. At least two connector components are deployed on each enterprise's intranet and have public network access addresses. The zero-trust gateway uses an adaptive control framework based on a dynamic risk graph generated from fused identity authentication results, device status detection data, and real-time behavior analysis data to dynamically control the granularity of network port access permissions for deployed devices, enhancing network access security. The network proxy module receives user data requests and asymmetrically encrypts them before initiating a validity verification request to the connector service module, ensuring data transmission security. The connector service module interacts with the data space platform to obtain and store transaction evidence and electronic contract information. It uses a deep fusion verification mechanism of contract terms and business context information to verify the legality of validity verification requests and return results, ensuring the legality and compliance of data transactions. Overall, this ensures the efficient and secure operation of the data space system in terms of data transactions, network security, and legality verification. In summary, the data space system realizes standardized transaction processes through the data space platform. Combined with zero-trust gateways and peer-to-peer direct connection channels, it enables efficient cross-enterprise connections while ensuring data security. It has the advantages of solving the data silo phenomenon, improving security protection capabilities, and reducing deployment and maintenance complexity.

[0021] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0022] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0023] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the data space system in an embodiment of the present invention; Figure 2 This is a schematic diagram of a zero-trust gateway in an embodiment of the present invention; Figure 3 This is a schematic diagram of the connector functional area in an embodiment of the present invention; Figure 4 This is a schematic diagram of the connector assembly of the data space system in an embodiment of the present invention; Figure 5A data flow method flowchart of a data space system in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings, it should be understood that the preferred embodiments described here are only used to explain and illustrate the present application, and are not used to limit the present application.

[0025] The present application provides a data space system, as shown in Figure 1 、 Figure 2 、 Figure 3 comprising: a data space platform for providing enterprise registration, connector component purchase and registration, data product release and transaction functions, and issuing a signed electronic transaction contract to the connector components of the buyer and seller; at least two connector components, as shown in Figure 4 each connector component is deployed in the corresponding enterprise intranet and has a public network access address, and comprises a zero trust gateway, a network proxy module and a connector service module; The zero trust gateway is used to control the access permission granularity of the network port of the deployment device based on a dynamic strategy, wherein the dynamic strategy generates an adaptive control framework based on a dynamic risk map by fusing identity authentication results, device state detection data and real-time behavior analysis data; The network proxy module is used to receive a data request of a user (referring to a buyer user), perform asymmetric encryption (such as RSA or ECC) processing on the requested data, and initiate an effectiveness verification request to the connector service module through a Socket communication interface; The connector service module is used to interact with the data space platform to obtain and store transaction evidence and electronic contract information, perform legality verification on the effectiveness verification request based on the transaction evidence and electronic contract information and return the result, and only allow the user holding the valid contract to pass the request, wherein the legality verification adopts a deep fusion verification mechanism of contract terms and business context information.

[0026] The data flow process corresponding to this embodiment includes: the enterprise user purchases a data product through the connector component in the data space platform and binds a specified connector; the transaction parties sign an electronic contract through the data space platform, after the contract signing is completed, the data space platform issues a transaction contract to the connector components of the buyer and seller; the buyer initiates a data request through the connector component, the network proxy module verifies the request effectiveness through Socket communication to the connector service module, and establishes a point-to-point data flow channel after the verification is passed, and the seller returns data to the buyer through the connector component.

[0027] The core contradiction of the existing foundation is how to realize the circulation of trusted data without relying on the central node. First, for the problem of identity authentication, the access control is decentralized to the enterprise side component, and fine-grained permission management is realized through dynamic policy. Then, to solve the problem of contract performance, an automatic contract issuing and evidence storage mechanism is designed to provide legal support for each request. Finally, to eliminate the risk of data transfer, a point-to-point direct connection architecture is adopted, and only the platform transaction matching function is retained. Therefore, the embodiment proposes a data space system, including a data space platform and a connector component. The data space platform handles enterprise registration, connector registration, and data product transaction. The connector component is deployed in the enterprise intranet and has a public network address, including a zero-trust gateway, a network proxy module, and a connector service module. In the data circulation process, the enterprise purchases data products through the connector and signs an electronic contract. After the contract is issued, the network proxy module verifies the validity of the request, establishes a direct connection channel, and completes data transmission.

[0028] Among them, the zero-trust gateway refers to a component that implements dynamic network access control, which can be implemented using software-defined border technology, and controls the opening range of the port by continuously verifying the device state and user identity. The network proxy module refers to a functional unit that handles encrypted communication and permission verification, such as encapsulating request data using the TLS protocol and verifying user permissions through digital certificates. The connector service module refers to a local service that stores contract information and transaction evidence, such as using blockchain technology to store contract hash values to provide verification basis for the proxy module.

[0029] Specifically, after the enterprise user completes the connector registration on the data space platform, they can publish standardized data products. When the buyer selects a product, the platform generates an electronic contract containing data format and access rules. After the contract is digitally signed by both parties, it is stored in the respective connector service modules. When the buyer initiates a data request, the network proxy module forwards the encrypted request to the connector service module, which judges the legality by comparing the contract terms and request parameters. After verification, the proxy module directly establishes an encrypted tunnel with the seller, bypassing the platform to complete data delivery.

[0030] Compared with the prior art, the traditional centralized platform needs to transfer all data traffic, which has performance bottlenecks and leakage risks. This scheme separates the transaction matching and data transmission functions, so that the platform only handles lightweight operations such as contract management, and the actual data transmission is completed by the enterprise's own connector. Compared with the scheme of directly exposing API interfaces, the zero-trust gateway continuously monitors the security state of the device, and can dynamically close unnecessary ports to avoid the expansion of the attack surface caused by long-term opening.

[0031] Through the technical solution, the embodiment effectively reduces the intermediate link risk in cross-enterprise data circulation, and ensures that the data transmission path is controllable. Through the contract binding and automatic verification mechanism, the dispute of the transaction parties on the authenticity of the data is eliminated. The point-to-point direct connection architecture reduces the data transfer link and improves the transmission efficiency of high-sensitive data. The dynamic access strategy is combined with the end-to-end encryption to prevent the internal network resources from being illegally scanned or stolen.

[0032] The application further proposes that the zero-trust gateway controls the access permission of the network port through a dynamic strategy, including multi-factor verification based on identity authentication, device state detection and real-time behavior analysis.

[0033] The dynamic strategy control refers to a technology for adjusting network port access rules according to real-time security posture, and can be implemented by using an attribute-based access control model. The access strategy is dynamically generated by continuously monitoring the changes in the network environment, and is used to solve the rigid problem of permission management caused by static strategy. The identity authentication refers to a process for verifying the legality of an access subject, and can be implemented by using an OAuth2.0 protocol or a digital certificate, and is used to ensure the credibility of the source of the access request. The device state detection refers to a technology for continuously monitoring the security baseline of a terminal device, and can be implemented by detecting the operating system patch version, the antivirus software state and the device fingerprint, and is used to block the terminal with security vulnerabilities from accessing the network. The real-time behavior analysis refers to a technology for dynamically identifying network traffic and operation mode, and can be implemented by using a machine learning algorithm or a rule engine, and is used to identify abnormal access requests by comparing historical behavior baselines, and is used to intercept potential attack behaviors.

[0034] Specifically, when a user initiates a network access request, the zero-trust gateway first verifies the legality of the user identity by using an identity authentication module, for example, checks the validity of an access token. Then, a device state detection module scans the security state of the user terminal, and if it is detected that a key patch is not installed or there is a malicious process, the connection is immediately blocked. After the identity and the device are verified, a real-time behavior analysis module deeply analyzes the request traffic, for example, detects whether there is a high-frequency port scanning or an abnormal protocol access behavior, and if an anomaly is found, a dynamic strategy adjustment is triggered, and the related port is temporarily closed or the access rate is limited. The above multi-factor verification forms a progressive protection mechanism, and only when the identity, the device state and the behavior characteristics all meet the security strategy, the access permission of the corresponding network port is allowed to be opened.

[0035] Compared with the prior art, the traditional network access control relies on fixed policy configuration and single password verification, and cannot cope with illegal access after the device is invaded or the user credential is leaked. The scheme combines dynamic policy and multi-factor verification, and superimposes device security state detection and real-time behavior monitoring on the basis of identity authentication, so that the port access permission can be dynamically adjusted according to the terminal security situation and operation risk, and the security vulnerability caused by the error of static policy configuration or the failure of single-point authentication can be effectively reduced.

[0036] Through the above technical solution, the embodiment solves the problem of lack of flexibility in permission management in the traditional network port access control, realizes real-time adjustment of the port open state through dynamic policy, and at the same time, blocks the terminal access of the terminal with security risks through superimposed device state detection and behavior analysis, and identifies abnormal operations disguised as legitimate users, so as to build a multi-level port protection system in a complex network environment.

[0037] The application further proposes a zero trust gateway, comprising: The transaction scenario portrait sub-module is used for obtaining user identity credentials based on the identity authentication result, obtaining a terminal device security baseline in a current data transaction scenario based on device state detection data, and analyzing a deviation rate of a request frequency from a historical request frequency, a matching degree of an actual data transmission amount and a contract agreed data transmission amount, and a geographical distance weight of a terminal IP and an enterprise registered location as scenario-based risk factors based on real-time behavior analysis data. The correlation risk identification sub-module is used for identifying a risk correlation relationship among the user identity credentials, the terminal device security baseline and the network behavior characteristics. The risk transmission analysis sub-module is used for mapping the user identity credentials, the terminal device security baseline and the network behavior characteristics into a dynamic risk map based on the risk correlation relationship, identifying all risk transmission paths of each scenario-based risk factor in the dynamic risk map, and quantifying a transmission influence weight of each scenario-based risk factor on each corresponding risk transmission path. The intelligent policy iteration sub-module is used for adjusting the access permission granularity of the network port of the device based on the transmission influence weight of all scenario-based risk factors on all corresponding risk transmission paths.

[0038] In this embodiment, first, the user identity credentials are obtained based on the identity authentication result. When logging in to a bank APP, after confirming that it is a personal operation through fingerprint recognition, password verification and other identity authentication methods, the system will generate a string of identity representing the user, which is the user identity credentials.

[0039] Based on the device state detection data, the current data transaction scenario terminal device security baseline is obtained, such as detecting mobile phone equipment, checking whether the operating system is updated in time, whether there is a regular antivirus software and other data, according to the standard formulated by the industry or enterprise, whether the mobile phone equipment meets the safety requirements in the data transaction scenario is determined, and the requirement standard is the security baseline.

[0040] For the deviation rate of the request frequency based on real-time behavior analysis data analysis and the average of the historical request frequency, assuming that an e-commerce platform, the average number of user requests for commodity information per hour in the past week is 50 times, and the request reaches 70 times in an hour today, the deviation rate is calculated as (70-50) ÷ 50 × 100% = 40%. Calculate the matching degree of actual data transmission volume and contract data transmission volume, if the enterprise and the cooperation party sign a contract to stipulate that the data transmission volume is 500GB, and the actual transmission is 450GB, the matching degree is 450 ÷ 500 × 100% = 90%. Determine the weight of the geographical distance between the terminal IP and the registered place of the enterprise, by obtaining the geographical position longitude and latitude corresponding to the terminal IP and the longitude and latitude of the registered place of the enterprise, the distance is obtained by using a special geographical distance calculation formula, and then the weight is set according to the distance, the weight is high when the distance is short, and the weight is low when the distance is far.

[0041] Identify the risk association between user identity credentials, terminal device security baseline and network behavior characteristics, for example, it is found that when the user identity credentials show that it is a newly registered user, the terminal device security baseline is low, such as there are many unpatched vulnerabilities, and the network behavior appears frequent abnormal access at this time, which indicates that there is a risk association between the three.

[0042] Based on the risk association, these are mapped into a dynamic risk map, which is like presenting these relationships in a visual graph, different elements and lines representing different relationships and transmission paths.

[0043] Identify all risk transmission paths of each scenario risk factor in the dynamic risk map, for example, the scenario risk factor is network delay, and the risk transmission path may be that it causes slow data transmission, and then affects the normal operation of the transaction process.

[0044] Quantify the transmission impact weight of each scenario risk factor on each corresponding risk transmission path, based on the risk event data of historical records, a matrix model containing all risk factors (matrix size is risk factor number n multiplied by risk factor number n) is established. Each element in the matrix corresponds to the transmission possibility between two risk factors, for example, the value of the element in the i-th row and the j-th column of the matrix represents the probability of "risk factor i transmission to risk factor j", for example, the probability of "identity abnormal risk factor transmission to device abnormal risk factor" is 65%.

[0045] The influence degree of each risk factor on the final risk result is calculated by using matrix multiplication operation. The quantitative values of all current risk factors are integrated into a vector form (i.e., a current risk factor quantization vector), and the vector is multiplied by the above-mentioned conduction probability matrix (specifically, the conduction probability matrix is multiplied by the transpose vector of the current risk factor quantization vector), and the operation result is a vector, and each element in the vector represents the comprehensive influence weight of each risk conduction path on the final risk result.

[0046] Finally, the network port access permission granularity of the deployment device is adjusted based on these weights: Suppose that the system exists Scenario-based risk factors (such as user identity anomaly, device security baseline not up to standard, behavior deviation, etc.), and a risk conduction probability matrix is constructed based on historical risk event data ( order , where represents the conduction probability of the scenario-based risk factor to the scenario-based risk factor . At the same time, the risk factor intensity vector is defined, where is the normalized intensity value of the risk factor (obtained by index quantization).

[0047] The risk conduction comprehensive influence weight formula is: In the formula, , the smaller the value is, the more strict the permission restriction is (for example, indicates that only 30% of the basic permissions are opened); is a natural exponential function and the value of e is 2.71828; is a risk sensitivity coefficient (a , which can be configured according to business scenarios, such as a financial scenario , a medical scenario ); is the comprehensive influence weight of the risk conduction path; is the scenario importance weight of the scenario-based risk factor (a , determined by the analytic hierarchy process AHP); is the maximum value.

[0048] The network agent module further encrypts the user request data by using an asymmetric encryption algorithm, and checks the user access right through the connector service module, and only allows the user request with a valid contract to pass.

[0049] The asymmetric encryption algorithm refers to an algorithm for realizing data encryption and decryption by using a public key and a private key pair, and can be realized by using an RSA or ECC algorithm, the public key is used for encrypting the user request data, and the private key is kept by the receiver and used for decryption, thereby avoiding the security risk of the key distribution link in the symmetric encryption algorithm.

[0050] Specifically, when the user initiates a data request, the network agent module encrypts the request content by using the public key of the receiver to generate an irreversible ciphertext data packet.

[0051] Compared with the prior art, the conventional data flow scheme usually relies on a symmetric encryption algorithm or a static right control not bound with a contract state, and has the problems of key leakage risk and right management rigidity.

[0052] Through the above technical scheme, the present application can prevent the data from being maliciously intercepted and decrypted during the transmission process, avoid the illegal acquisition of data resources by the users without signing the contract or the holders of invalid contracts, and ensure that the data flow process meets the confidentiality requirement and the contract compliance constraint.

[0053] The connector service module further interacts with the network agent module through Socket communication, the network agent module sends a request verification instruction to the connector service module, the connector service module checks the request legality according to the pre-stored contract information and returns a verification result, and the network agent module decides whether to release the user request according to the verification result.

[0054] The Socket communication refers to an end-to-end two-way communication channel established based on a transport layer protocol, can be specifically implemented by using a TCP protocol, and realizes low-delay real-time interaction by maintaining a long connection, and the Socket communication is used to ensure efficient transmission of the verification request and the response. The request verification instruction refers to a verification trigger signal generated by the network proxy module when the user data request is received, can be specifically encapsulated by using a JSON format, and is used to forcibly trigger the permission checking process. The pre-stored contract information refers to the clause data stored in the connector service module after the electronic contract is signed, can be specifically implemented by using a block chain storage technology to realize tamper-proof storage, and is used to provide a trusted basis for the legality judgment. The verification result refers to a determination conclusion of the connector service module on whether the request meets the contract clauses, can be specifically returned in the form of a Boolean value or a status code, and is used to provide an input condition for the access control decision.

[0055] Specifically, when the user initiates a data request, the network proxy module sends the request parameters to the connector service module through the established Socket connection. The connector service module extracts the user identity, data identifier and operation type in the request, and compares them with the authorized range in the pre-stored contract. If the request parameters match the data user, the permitted data set and the operation permission agreed in the contract, a verification pass signal is returned, and the network proxy module immediately establishes a point-to-point transmission channel; if it is detected that the request exceeds the authorized range of the contract, a verification failure signal is returned, and the network proxy module immediately terminates the request and records an abnormal log. The process ensures that each request is dynamically checked through the real-time communication mechanism between the modules, and avoids illegal access caused by expired or misconfigured static permission configuration.

[0056] Compared with the prior art, the traditional scheme depends on the centralized platform to transfer the verification request, and has high response delay and single-point failure risk. The connector service module deployed locally in the scheme directly processes the verification request, reduces the performance loss caused by network jumping, and uses the persistent connection feature of the Socket communication to control the verification delay to be in the millisecond level. The permission checking based on the API gateway in the prior art only checks the validity of the access token, and cannot associate specific contract clauses, while the scheme realizes fine-grained access control through fine matching of the contract information and the request parameters.

[0057] Through the above technical scheme, the application can intercept access requests that are not signed or exceed the permission in the data flow process in real time, effectively preventing data abuse. The automatic verification mechanism based on the contract clauses replaces manual review, significantly reducing the risk of violations caused by operation errors. Through the combination of local verification decision and point-to-point transmission, the data leakage risk of the central node is eliminated, and the controllability of the data transmission path is ensured.

[0058] The data space platform does not participate in the data flow process, and only serves as a platform for transaction negotiation and contract management, and the data flow is directly completed by the connector components of the buyer and the seller.

[0059] The data space platform refers to a third-party neutral platform providing enterprise registration, connector registration and contract signing functions, and can be implemented by using a smart contract system based on a block chain, and is used for storing transaction terms and signed electronic contracts, but does not have a physical channel for data flow.

[0060] Specifically, after the buyer and the seller complete transaction negotiation and sign an electronic contract on the data space platform, the contract information is encrypted and transmitted to the corresponding connector components of the two parties. When the buyer initiates a data request through the locally deployed connector component, the network proxy module matches and verifies the request parameters with the contract terms, and establishes an encrypted communication link with the seller connector component after verification. In the data flow process, all transmission traffic is completed through the point-to-point channel between the connector components, and the data space platform only saves the transaction evidence and the contract hash value, and does not participate in actual data transmission or storage.

[0061] Compared with the prior art, the traditional data flow platform needs to store data in the centralized server for forwarding, and there is a risk of being attacked maliciously or stolen by internal personnel. The direct communication mechanism of the connector component eliminates the data transfer link of the centralized platform, so that the attacker cannot obtain the data content by controlling the platform server, and the illegal copying behavior of the platform operator to the data is avoided.

[0062] Through the above technical solution, the data leakage risk caused by the participation of the centralized platform in the data flow is solved, the data only flows between the transaction parties through the point-to-point transmission mechanism, and the network attack surface is effectively reduced; and through the contract verification function of the connector component, it is ensured that the data flow behavior strictly follows the pre-signed terms, and unauthorized data access or tampering behavior is avoided.

[0063] The data product release needs to be bound to the connector component, the seller can only provide the data product to the buyer through the bound connector component, and the buyer must initiate the request through the bound connector component.

[0064] The binding connector component refers to establishing a unique association between the product and a specific connector in the data product release stage, which can be implemented by digital signature or registry mapping, and is used to ensure that the identity of the data product release subject is verifiable. The data product provided by the seller through the binding connector component refers to limiting the data output path to only allow the transmission operation of the authenticated connector, which can be implemented by access control list or device fingerprint verification, and is used to prevent unauthorized devices from participating in data distribution. The request initiated by the buyer through the binding connector component refers to the requirement that the data request must come from the pre-registered legal connector, which can be implemented by two-way certificate authentication or dynamic token mechanism, and is used to block illegal request paths.

[0065] Specifically, in the data product release process, the seller needs to register the connector component on the data space platform and bind the product metadata with the connector identity information. When the buyer initiates a data request, the network proxy module first verifies whether the request source matches the connector device certificate bound by the buyer, and refuses to establish a communication link if the verification fails. In the data transmission stage, the seller connector service module checks the binding relationship between the data product and the current connector, and only allows the data encapsulation and sending operation through the connector. Thus, a full-link device identity binding mechanism is formed from request initiation to data delivery, ensuring that the transaction parties can only interact through the pre-verified legal devices.

[0066] Compared with the prior art, the traditional data circulation scheme does not require the binding relationship between the data product and the transmission device, and there is a risk that third-party devices will impersonate legal transaction subjects or illegally hijack data channels. The present scheme establishes a two-way device binding mechanism between the release end and the request end, which completes the device identity verification before data circulation, thereby eliminating the possibility of unauthorized device access from the root, and at the same time, the encryption communication capability of the connector component ensures the tamper resistance of the binding relationship.

[0067] Through the above technical scheme, the present application can ensure the credibility of the data product source and prevent unverified devices from impersonating legal transaction parties. Illegal data requests initiated through non-binding connectors are effectively blocked, and unauthorized devices are prevented from intercepting or tampering with data during transmission. The data transmission path is forcedly constrained by the device-level binding relationship, thereby reducing the risk of man-in-the-middle attacks or data leakage.

[0068] The present application further proposes an electronic contract signing process comprising the following steps: the buyer and seller upload identity credentials and transaction terms on the data space platform; the data space platform generates a contract draft and sends it to both parties for confirmation; both parties complete digital signature through the connector service module, and the contract is automatically stored in the connector service module after signing.

[0069] The identity credential refers to an electronic proof material capable of verifying the authenticity of the transaction subject, which can be implemented by a digital certificate, biometric identification data or a scanned copy of a business license, and is used to ensure the legal subject qualification of the contract signing party. The transaction terms refer to the right and obligation agreement involved in the data transaction, which can be implemented in a structured data template or natural language text format, and is used to clearly define the core elements such as data usage range, pricing method and delivery standard. The contract draft refers to a standardized legal text automatically generated according to the submitted terms by both parties, which can be implemented by an intelligent contract template or a legal clause database matching algorithm, and is used to eliminate semantic ambiguity in the manual negotiation process. The digital signature refers to an electronic signature technology based on asymmetric encryption algorithm, which can be implemented by RSA signature or elliptic curve digital signature algorithm, and is used to verify the identity of the signer and ensure the integrity of the contract content. The connector service module storage function refers to the persistent storage of the signed electronic contract, which can be implemented by a block chain storage or a distributed file storage system, and is used to form an unalterable transaction storage record.

[0070] Specifically, when the buyer and seller complete the transaction term negotiation in the data space platform, the identity credential is transmitted to the platform through an encrypted channel for authenticity verification. The platform calls the preset legal clause library to generate a contract draft containing the rights and obligations of both parties. The draft converts the transaction terms into a text structure with legal force through a standardized template. Both parties call the pre-installed digital certificate through the connector service module, perform signature operation after hash operation on the contract content, and the signature process is completed in an encrypted sandbox environment to prevent private key leakage. The signed contract is split into multiple data blocks and attached with timestamp information, stored in the distributed database of the connector service module through the Merkle tree structure, forming a verifiable storage chain.

[0071] Compared with the prior art, the traditional electronic contract signing relies on third-party certification agencies for manual review, and has the problems of complicated process and scattered storage. In the prior art, the contract terms are mostly in free text format, which is easy to cause clause interpretation controversy, and lacks automatic docking capability with underlying technical facilities. The present scheme realizes the machine readability of the contract terms and the non-repudiation of the storage data through the standardized contract generation mechanism and the distributed storage design, and deeply integrates the signature operation with the existing identity management system of the enterprise.

[0072] Through the technical solution, the application realizes full-chain automatic management of the contract signing process, ensures accurate conversion of transaction terms and legal effect of signing behavior, and effectively prevents the risk of signing by impersonation through the encrypted transmission and verification mechanism of identity credentials, and eliminates clause interpretation ambiguity through the standardized contract template. The combination of digital signature and distributed evidence storage makes the contract status verifiable in real time, providing a complete evidence chain for transaction disputes. The storage function of the connector service module ensures seamless connection of contract data and enterprise internal systems, and supports automatic permission verification during subsequent transaction execution.

[0073] The application further proposes that the connector assembly is deployed in the enterprise intranet, the public network address thereof is accessed externally through NAT penetration or reverse proxy, and the security of the intranet server is ensured through the dynamic access control policy of the zero-trust gateway.

[0074] The NAT penetration refers to direct communication between intranet devices and external networks through address conversion technology, which can be implemented by using UDP hole punching or STUN protocol, and the technology allows two-way communication establishment in a dynamic IP environment, avoiding direct exposure of the real address of the intranet. The reverse proxy refers to receiving external requests through an intermediate server and forwarding them to intranet devices, which can be implemented by using tools such as Nginx or HAProxy, and the technology hides the intranet topology structure and only exposes the proxy server address. The dynamic access control policy refers to a mechanism for adjusting network port permissions based on real-time verification results, which can be implemented by using a policy engine based on identity authentication, device state detection and behavior analysis, and the mechanism continuously verifies the legitimacy of the access subject.

[0075] Specifically, the connector assembly is deployed in the enterprise internal network environment, and dynamic IP devices obtain public network accessibility through NAT penetration technology, or external requests are forwarded to the intranet connector through a reverse proxy server. The zero-trust gateway performs multi-factor verification on each access request, for example, when an external user attempts to access the connector, the gateway detects the device fingerprint, user identity certificate and behavior pattern of the request source in real time, and if an abnormal login location or abnormal data request frequency is detected, the corresponding port access permission is immediately closed. The scheme allows external legal access while blocking unverified connection attempts through dynamic strategies, so that attackers cannot use fixed open ports to implement intrusion.

[0076] Compared with the prior art, the traditional scheme usually opens a fixed port by a static firewall rule, and an attacker can detect the exposed port for a long time to implement penetration. The present scheme temporarily opens the necessary port only when the verification is passed through the dynamic strategy, for example, the port is automatically closed after the data flow is completed, eliminating the risk of long-term exposure. The existing reverse proxy technology only realizes address hiding, but lacks dynamic verification of forwarded requests. The present scheme combines the zero trust mechanism to perform real-time behavior analysis on the proxy request, for example, detecting whether the data packet characteristics meet the access mode agreed in the contract.

[0077] Through the above technical scheme, the application effectively reduces the risk of port scanning attack on the intranet server exposed by the public network, prevents unauthorized devices from accessing intranet resources through the NAT or proxy channel, and ensures that the data flow process is only executed in a legal session verified by a dynamic strategy.

[0078] The application further proposes that the transaction evidence recorded by the connector service module includes: a transaction timestamp, identity information of both parties, data product metadata, an electronic contract hash value, and an access log of the network proxy module.

[0079] The transaction timestamp refers to a mark accurately recording the time when the data circulation occurs, which can be realized by time server synchronization or a blockchain timestamp service, and is used to establish a time reference for the transaction event. The identity information of both parties refers to the unique identification data of the transaction participants, which can be realized by a digital certificate or an enterprise unified social credit code, and is used to confirm the authenticity of the transaction subject identity. The data product metadata refers to structured information describing the attributes of the data product, which can be realized by JSON-LD or XML format, and is used to clearly define the content and specifications of the transaction object. The electronic contract hash value refers to a unique identification of the contract text generated by a hash algorithm, which can be realized by SHA-256 or SM3 algorithm, and is used to verify the integrity of the contract content. The access log of the network proxy module refers to structured logs recording the data request time, source address, target address, and operation type, which can be realized by Syslog protocol or ELK technology stack, and is used to trace the operation behavior of the whole process of data circulation.

[0080] Specifically, when the buyer initiates a data request through the connector component, the network agent module submits the request time, the identities of the two parties, and the data product identity to the connector service module. The connector service module calls the pre-stored electronic contract hash value for matching verification, and generates a notarization record containing a timestamp after confirming the validity of the contract. During the data flow process, the network agent module continuously records access logs, including the requester's IP address, packet size, and transmission status. All notarization information is stored through encryption to form an unalterable evidence chain, such as anchoring the timestamp and hash value to a distributed ledger using blockchain notarization technology. When a transaction dispute arises, the auditor can verify the transaction timing by calling the timestamp in the notarization information, confirm the consistency of the contract terms by comparing the electronic contract hash value, and restore the data flow path through the access log, thereby quickly locating the disputed link.

[0081] Compared with the prior art, the traditional data flow system usually only records the transaction time and the basic contract information, lacks the associated notarization of the data product attributes, operation logs, and contract integrity. For example, existing solutions may use a database to store transaction time and participant names, but cannot verify whether the contract content has been tampered with, and lack detailed records of data request behavior. The present solution records multiple dimensions of notarization elements in coordination, such as storing data product metadata and contract hash values together, so that during auditing, the consistency of the transaction object and the contract provisions can be verified; through cross-verification of access logs and timestamps, the occurrence node of data leakage or irregular operation can be accurately traced back.

[0082] Through the above technical solutions, the present application solves the problem of difficult dispute tracing caused by missing notarization information in the data flow process. By solidifying the transaction time reference, identity, data attributes, and operation logs, a verifiable evidence closed loop is formed, enabling auditors to quickly verify the legality of transactions based on notarization information. For example, when the buyer questions the received data and the contract provisions, the data specification can be verified by calling the metadata field in the notarization, and the possibility of contract tampering can be ruled out by comparing the hash values, thereby reducing the manual review cost required for dispute resolution.

[0083] The present application further proposes that the network agent module, upon receiving a user data request, will perform a specific encryption and transmission strategy for large file data. Considering that asymmetric encryption algorithms perform excellently in terms of security, but for large files, the encryption and decryption speed is relatively slow, in order to ensure that the encryption efficiency is not significantly lower than that of unencrypted transmission, we use a combination of fragmentation encryption and parallel transmission.

[0084] Considering the complexity and real-time variability of the network environment, we dynamically determine the optimal fragmentation size based on real-time network state parameters. The current real-time monitored network bandwidth is (unit: MB / s), since network jitter will affect the stability of transmission, we introduce the network jitter coefficient , which is obtained by statistical analysis of network bandwidth fluctuations in the last 30 seconds). At the same time, in order to fully utilize system resources, the number of parallel transmission threads is set to , which can be dynamically adjusted according to the number of server CPU cores and system load), and the minimum slice size (such as 1MB) and the maximum slice size (such as 10MB) are pre-set to ensure that the slice size is within a reasonable range. The formula for calculating the optimal slice size is as follows: wherein is the target slice transmission time, which can be flexibly configured according to business requirements, for example, set to 1 second; is the minimum value, is the maximum value.

[0085] The core idea of this formula is to consider the network bandwidth, jitter, number of parallel threads, and pre-set slice size range to calculate the optimal slice size that can fully utilize the network bandwidth and avoid excessive overhead due to too small slice size or transmission timeout due to too large slice size.

[0086] To measure the impact of encryption processing on large file data transmission performance, we define the encryption transmission efficiency index . It quantitatively evaluates the transmission time (unit: seconds) in the unencrypted state and the transmission time (unit: seconds) in the encrypted state by comparing them, and the calculation formula is as follows: Through the above dynamic slice encryption and parallel transmission technology, the encryption transmission efficiency index η is always maintained at a level not lower than 80%, that is, the data transmission efficiency after encryption is not significantly lower than that without encryption, thereby ensuring data security while minimizing the negative impact of encryption operations on transmission efficiency.

[0087] By implementing the above complex and delicate large file data slice encryption and parallel transmission efficiency optimization technology scheme in the network proxy module, the transmission efficiency and security of data in complex network environments can be effectively improved, meeting the needs of different business scenarios for safe and efficient transmission of large file data.

[0088] The application further proposes a process for verifying the legitimacy of the connector service module, including: ​​All contract terms in the electronic contract information are parsed into an executable business rule base, and all constraint items and corresponding associated conditions of each executable business rule in the executable business rule base are determined; Based on the request parameters and business context information of the validity verification request and the historical behavior characteristics in the transaction record, the real business intention of the user is identified; Based on the real business intention of the user, all constraint items and corresponding associated conditions of all executable business rules in the executable business rule base, and the transaction record, the validity verification request is legally checked and the result is returned.

[0089] In the scenario of this embodiment, all contract terms in the electronic contract information, such as the delivery form of the data product, the use range, the price setting, etc., are converted into a rule set that can be followed and executed by the computer through a specific analysis and disassembly method, which constitutes an executable business rule base.

[0090] Taking the rule of the delivery form of the data product as an example, all constraint items of the rule, such as the delivery time limit within a few working days after the contract is signed, the data format of the delivery must be a specific standard format, etc., and the corresponding associated conditions, such as only after the buyer completes the full payment, the delivery process is started.

[0091] The request parameters of the validity verification request, for example, in the data product transaction contract modification request, the request parameters may contain changes to the use rights of the data product, adjustments to the data delivery period, etc., which need to be verified whether they meet the original agreement of the contract and the relevant specifications of the data transaction market.

[0092] The business context information in the data product transaction scenario covers the market dynamics of the field to which the data product belongs, legal and regulatory restrictions, etc. For example, if the data product involves personal information, the relevant privacy regulations are business context information.

[0093] The historical behavior characteristics in the transaction record, such as in the past data product transaction record, a certain enterprise has always preferred to purchase a specific type of data product, and the purchase frequency is relatively regular, which is its historical behavior characteristics.

[0094] Based on the request parameters of the validity verification request, such as the request parameter of modifying the use range of the data product, combined with the business context information, such as the new regulations of the current data market for a specific data use range, and combined with the historical behavior characteristics in the transaction record, such as the case that the enterprise previously expanded the use range of the data product due to business expansion, the real business intention of the user is identified. For example, the user requests to expand the use range of the data product, combined with the trend of relaxing the use range of such data in the current market (business context information), the behavior of expanding the use range due to business expansion in the past (historical behavior characteristics), and the specific range of expansion in the request parameter, it is judged that the real intention of the user may be to expand the business and need more data support, so as to apply for expanding the use range.

[0095] The application further proposes to perform legality verification on the validity verification request based on the real business intention of the user, all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and the transaction record, including: generating a current intention vector based on the real business intention of the user, and determining a legal intention vector library based on the electronic contract information; obtaining an intention matching degree based on the cosine similarity between the current intention vector and all legal intention vectors in the legal intention vector library; generating an executable business rule matrix based on all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and constructing a transaction behavior matrix based on the same matrix and the transaction record; calculating the matching degree of the executable business rule matrix and the transaction behavior matrix as the legality degree of the transaction behavior; calculating the legality verification score based on the intention matching degree and the legality degree of the transaction behavior.

[0096] In the scenario of this embodiment, a current intention vector is first generated according to the real business intention of the user. For example, the real intention of the user is to expand the use range of the data product, and this intention is converted into a vector composed of a group of numbers by a specific mathematical method to represent the characteristics of this intention, which is the current intention vector.

[0097] Determining a legal intention vector library based on the electronic contract information is to convert various legal intentions specified in the electronic contract, such as using the data product according to the contract and paying the data product fee on time, into vectors respectively, and then collecting them to form the legal intention vector library.

[0098] The cosine similarity between the current intention vector and all legal intention vectors in the legal intention vector library is calculated to obtain the intention matching degree. The similarity value is calculated by the cosine similarity formula, and this value is the intention matching degree, which is used to measure the closeness between the current intention and the legal intention.

[0099] An executable business rule matrix is generated based on all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library. For example, there is a data product delivery rule in the rule library, the constraint items are delivery time and delivery data format, and the associated condition is delivery after payment. These information is arranged in a matrix form in a certain order, and the rows may represent different rules, and the columns represent constraint items and associated conditions and other information.

[0100] The transaction behavior matrix is constructed based on the same matrix as the rule, that is, the transaction behavior information in the transaction evidence is converted into a matrix, such as the actual delivery time and the actual used data format.

[0101] The matching degree of the executable business rule matrix and the transaction behavior matrix is calculated as the legality of the transaction behavior. For example, by comparing the consistency degree of the corresponding position elements of the two matrices, a certain scoring standard is set, and the matching degree value is calculated. The higher the value, the more legal the transaction behavior is.

[0102] Finally, the legality verification score is calculated based on the intention matching degree and the transaction behavior legality. Assuming that the intention matching degree accounts for 40%, and the transaction behavior legality accounts for 60%, if the intention matching degree is 0.8 and the transaction behavior legality is 0.7, the legality verification score = 0.8*40% + 0.7*60% = 0.32 + 0.42 = 0.74. This score is used to comprehensively evaluate the legality of the entire data product transaction.

[0103] As shown in Figure 5 The present application provides a data flow method of a data space system, comprising: The connector component deployed in the local intranet completes the registration process of the enterprise user in the data space platform, and binds the connector component with the enterprise identity; The data space platform publishes the seller data product and associates it to the seller connector component, and after receiving the target data product selection instruction input by the buyer, the platform receives the electronic contract signing result of both parties; The data space platform issues the signed transaction contract to the connector components of the buyer and seller, and the contract information is stored in the connector service modules of both parties; The network proxy module of the buyer's local connector component initiates a data request, and after encrypting the requested data based on the network proxy module, the network proxy module sends a verification request to the local connector service module through Socket communication; The connector service module verifies the legality of the verification request based on the pre-stored electronic contract information, and returns a permission instruction if the verification is passed; When it is monitored that the network agent module receives the permission instruction, a point-to-point encrypted transmission channel between the connector component of the buyer and the connector component of the seller is established, the data product transmission is completed through the point-to-point encrypted transmission channel without passing through the data space platform, so as to reduce the data leakage risk, and at the same time, the transaction timestamp, the data product metadata and the access log of the connector service module of the two parties are recorded as transaction evidence.

[0104] The point-to-point direct connection establishes a data transmission channel, which means that a communication link is directly established between the connector components of the buyer and the seller, and can be implemented by using a WebRTC protocol or a TCP direct connection technology. This way reduces the data exposure surface by eliminating intermediate forwarding nodes. The data space platform does not need to pass through the server node of the data space platform, and can be directly routed to the seller connector component after the network agent module parses the target address. This design avoids data flowing through the server of the third-party platform.

[0105] Specifically, when the buyer initiates a data request through the connector component, the network agent module first verifies the request legality through encrypted communication to the connector service module. The verification basis includes the pre-stored electronic contract hash value and the transaction evidence information. After confirming that the request party has valid contract authorization, the network agent module parses the public address of the seller connector component and establishes an end-to-end encrypted channel through NAT penetration technology. During data transmission, the data space platform does not participate in traffic forwarding, and only retains transaction evidence records for subsequent audit. In this way, data is only encrypted and transmitted between the connector components of the buyer and the seller, avoiding the potential leakage risk of data needing to be forwarded through the centralized platform server in the traditional scheme.

[0106] In some specific embodiments, the point-to-point direct connection channel can use a two-factor authentication mechanism, such as verifying the device fingerprint and the contract signing party information at the same time when establishing the connection. In addition, a dynamic key rotation strategy can be implemented during data transmission, such as updating the symmetric encryption key every fixed time interval.

[0107] Compared with the prior art, the traditional data flow scheme relies on a centralized platform as a data transmission intermediary, such as forwarding request and response data through the platform server. Such architecture has the risk of platform server being attacked or internal personnel stealing data. The present scheme uses a direct connection mechanism after verification, so that data is only transmitted between terminal nodes, effectively eliminating the possibility of data exposure in the middle link.

[0108] By the technical scheme, the application solves the data leakage risk problem caused by the traditional centralized platform transfer, specifically: the point-to-point direct connection channel eliminates the link of data flowing through the third-party server, reduces the threat of the intermediate node being attacked or monitored; through the cooperative mechanism of contract verification and direct connection address resolution, it is ensured that the data transmission path only exists between the legal transaction subjects; through the design of decoupling of the encrypted channel and the platform business, the decentralization of data circulation is realized while maintaining the transaction evidence function.

[0109] Obviously, those skilled in the art can make various modifications and variations to the application without departing from the spirit and scope of the application. Thus, if these modifications and variations of the application belong to the scope of the application and its equivalent technology, the application also intends to include these modifications and variations.

Claims

1. A data space system, characterized by The application relates to a data space platform and a connector component. The data space platform is used for providing enterprise registration, purchase and registration of connector components, release and transaction functions of data products, and issuing a signed electronic transaction contract to the connector components of the buyer and the seller. The connector component is deployed in a corresponding enterprise intranet and has a public network access address, and comprises a zero-trust gateway, a network proxy module and a connector service module. The zero-trust gateway is used for controlling the access permission granularity of the network port of a deployment device based on a dynamic strategy. The network proxy module is used for receiving a data request of a user, performing asymmetric encryption processing on the requested data, and initiating an effectiveness verification request to the connector service module through a Socket communication interface. The connector service module is used for interacting with the data space platform to obtain and store transaction evidence and electronic contract information, performing legality verification on the effectiveness verification request based on the transaction evidence and the electronic contract information and returning a result, wherein the legality verification adopts a deep fusion verification mechanism of contract terms and business context information.

2. The data space system of claim 1, wherein, The zero-trust gateway comprises: A transaction scenario portrait submodule is used for obtaining a user identity credential based on an identity authentication result, obtaining a terminal device security baseline in a current data transaction process based on device state detection data, and analyzing a deviation rate of a request frequency from a historical request frequency average, a matching degree of an actual data transmission amount and a contract agreed data transmission amount, and a geographical distance weight of a terminal IP and an enterprise registration location based on real-time behavior analysis data, as scenario-based risk factors. An associated risk identification submodule is used for identifying a risk association relationship among the user identity credential, the terminal device security baseline and the network behavior characteristics. A risk transmission analysis submodule is used for mapping the user identity credential, the terminal device security baseline and the network behavior characteristics into a dynamic risk graph based on the risk association relationship, identifying all risk transmission paths of each scenario-based risk factor in the dynamic risk graph, and quantifying the transmission influence weight of each scenario-based risk factor on each corresponding risk transmission path. An intelligent strategy iteration submodule is used for adjusting the access permission granularity of the network port of the deployment device based on the transmission influence weight of all scenario-based risk factors on all corresponding risk transmission paths.

3. The data space system of claim 1, wherein, The public network access address of the connector component is realized through NAT penetration or reverse proxy technology.

4. The data space system of claim 1, wherein, The asymmetric encryption processing adopts RSA algorithm or ECC algorithm. The Socket communication interface is a long connection interface based on TCP protocol, and supports real-time interaction between the network proxy module and the connector service module.

5. The data space system of claim 1, wherein, The transaction evidence recorded by the connector service module comprises a transaction timestamp, buyer and seller identity information, data product metadata, an electronic contract hash value and an access log of the network proxy module.

6. The data space system of claim 1, wherein, The legality verification process of the connector service module comprises: Parsing all contract terms in the electronic contract information into an executable business rule library, and determining all constraint items and corresponding associated conditions of each executable business rule in the executable business rule library; Based on the request parameters and business context information of the validity verification request and the historical behavior characteristics in the transaction record, the real business intention of the user is identified; Based on the real business intention of the user, all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and the transaction record, the legality verification of the validity verification request is performed and the result is returned.

7. The data space system of claim 6, wherein, Based on the real business intention of the user, all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and the transaction record, the legality verification of the validity verification request is performed, including: Generating a current intention vector based on the real business intention of the user, and determining a legal intention vector library based on the electronic contract information; Obtaining an intention matching degree based on the cosine similarity between the current intention vector and all legal intention vectors in the legal intention vector library; Generating an executable business rule matrix based on all constraint items and corresponding associated conditions of all executable business rules in the executable business rule library, and constructing a transaction behavior matrix based on the same matrix and the transaction record; Calculating the matching degree of the executable business rule matrix and the transaction behavior matrix as the legality degree of transaction behavior; Based on the intention matching degree and the legality degree of transaction behavior, a legality verification score is calculated.

8. A connector component of a data space system, characterized in that It includes: A zero-trust gateway is deployed at the boundary of an enterprise intranet and is configured with a dynamic policy engine for generating access control policies based on user identity legality, terminal device security state and real-time operation behavior, and performing network port access control; A network proxy module is in communication connection with the zero-trust gateway, used to receive external data requests, process the request data using an asymmetric encryption algorithm, and send verification instructions to the connector service module through Socket communication; The connector service module is in communication connection with the network proxy module and the data space platform, configured to: obtain and store electronic contract information and transaction record data from the data space platform, perform legality verification on the verification instructions based on the electronic contract information and return the result, trigger the establishment of a point-to-point data transmission channel between the proxy module and the target connector component after the verification is passed, and record the access log of the data request.

9. The connector assembly of a data space system of claim 8, wherein, The point-to-point data transmission channel is realized by using TCP direct connection technology, and dynamic key rotation is performed during transmission; the transaction record data includes contract hash value, data product metadata and access log.

10. A data flow communication method of a data space system, characterized by, It includes: Through the connector component deployed in the local intranet, the registration process of enterprise users is completed in the data space platform, and the connector component is bound to the enterprise identity; Through the data space platform, the seller's data product is published and associated to the seller's connector component, and after receiving the target data product selection instruction input by the buyer, the electronic contract signing result of both parties is received through the platform; The data space platform issues the signed transaction contract to the connector components of the buyer and seller, and the contract information is stored synchronously in the connector service modules of both parties; Initiating a data request through the network agent module of the buyer's local connector component, and based on the network agent module encrypting the requested data, sending a verification request to the local connector service module through Socket communication; Through the connector service module, verifying the legality of the verification request based on the pre-stored electronic contract information, and if the verification is passed, returning a permission instruction; When it is monitored that the network agent module receives the permission instruction, a point-to-point encrypted transmission channel between the connector component of the buyer and the connector component of the seller is established, the transmission of the data product is completed through the point-to-point encrypted transmission channel, and at the same time, the transaction timestamp, data product metadata and access log of the two parties are recorded as transaction evidence based on the connector service modules of the two parties.

Images