Method, apparatus, medium and device for controlling data access interface

Abstract

The embodiments disclosed in the specification provide a control method, device, medium and equipment of a data access interface. Data owned by a first user stored in a data storage system can be notarized in a blockchain. When a second user wants to call a data access interface for accessing the data owned by the first user, the data storage system can determine whether the data accessible by the data access interface called by the second user is notarized in the blockchain. If the determination result is yes, the data access interface can be provided to the second user for calling. If the determination result is no, the data access interface can be refused to be provided to the second user for calling.

Description

Technical Field

[0001] This specification relates to the field of database technology in several embodiments, and in particular to a control method, apparatus, medium and device for a data access interface. Background Technology

[0002] Currently, data storage systems can provide users with data storage and access services. A common service model involves users submitting their data to the data storage system for storage, and the system then providing an access interface for that data, which the user can call to access the data.

[0003] In practice, other users besides the user may also be able to call the data access interface. Therefore, how to effectively deal with the situation where "other users who do not own the data call the data access interface to maliciously tamper with the data" is a technical problem that urgently needs to be solved. Summary of the Invention

[0004] Several embodiments of this specification provide a control method, apparatus, medium, and device for a data access interface.

[0005] The technical solutions provided in several embodiments of this specification are as follows:

[0006] According to a first aspect of several embodiments of this specification, a control method for a data access interface is proposed, applied to a data storage system, wherein the data storage system stores a data set owned by a first user, the data storage system provides a corresponding data access interface to the outside world for each piece of data in the data set, and at least a portion of the data in the data set is stored on a blockchain, the method comprising:

[0007] In response to a second user's request to invoke the data access interface, it is determined whether the data accessible by the data access interface is stored on the blockchain; the second user is not the same user as the first user.

[0008] If the judgment result is yes, then the data access interface is provided to the second user for invocation; if the judgment result is no, then the data access interface is refused to be provided to the second user for invocation.

[0009] According to a second aspect of several embodiments of this specification, a control device for a data access interface is provided, applied to a data storage system, wherein the data storage system stores a data set owned by a first user, the data storage system provides a corresponding data access interface to the outside world for each piece of data in the data set, and at least a portion of the data in the data set is stored on a blockchain, the device comprising:

[0010] The judgment module, in response to a second user's request to call the data access interface, determines whether the data accessible by the data access interface is stored on the blockchain; the second user is not the same user as the first user.

[0011] If the judgment result is yes, the processing module will provide the data access interface to the second user for invocation; if the judgment result is no, it will refuse to provide the data access interface to the second user for invocation.

[0012] According to a third aspect of several embodiments of this specification, a data storage system as described in the first aspect of the method is proposed.

[0013] According to a fourth aspect of several embodiments of this specification, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method of the first aspect.

[0014] According to a fifth aspect of several embodiments of this specification, a computing device is provided, including a memory and a processor; the memory is used to store computer instructions executable on the processor, and the processor is used to implement the method of the first aspect when executing the computer instructions.

[0015] In the above technical solution, the data stored by the data storage system can be proven on the blockchain. When a second user wants to call the data access interface for accessing the data owned by the first user, the data storage system can determine whether the data accessible by the data access interface to be called by the second user is proven on the blockchain. If the determination result is yes, it means that even if the second user tampers with the corresponding data through the data access interface, the first user can also provide evidence of the second user's data tampering behavior based on the original data proven on the blockchain. Therefore, the data access interface can be provided to the second user for calling. If the determination result is no, it means that the first user cannot prove the second user's behavior of tampering with the corresponding data through the data access interface. Therefore, the data access interface can be refused to be provided to the second user for calling.

[0016] The above technical solutions can effectively prevent third parties (users who own the data and third parties outside the data storage system) from tampering with the data in the data storage system. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a control method for a data access interface provided in this specification.

[0018] Figure 2 This is an architecture diagram provided in this manual, which includes an application for a first user, an application for a second user, a data storage system, and multiple evidence storage service systems.

[0019] Figure 3 This is a schematic diagram of a data storage method provided in this specification.

[0020] Figure 4 This is a schematic diagram of a data access method provided in this manual.

[0021] Figure 5 This is a schematic diagram of the control device for a data access interface provided in this specification. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0023] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0024] The data storage system described in this article can refer to a software system with data storage function, such as a cloud storage system, or more specifically, an object storage system. An object storage system stores data in units of objects and can be used to store copyrighted works, such as music, videos, and images. Each copyrighted work is an object.

[0025] Current data storage systems provide data storage and access services to users. These users can be individuals or organizations. In practice, a user might be the administrator of an internet application, whose data can be submitted to the data storage system for storage. The application can also access the data storage system to read and modify data as needed for its business operations.

[0026] Typically, the owner of data in a data storage system is the user who submits the data to the system for storage, and usually only the user who owns the data has the right to modify it. Current data storage systems usually provide a data access interface for the corresponding data. This interface is a general interface based on the HTTP protocol. Therefore, theoretically, users other than the user who owns the data may also call this data access interface. There are two possibilities here:

[0027] 1. The user who owns the data does not expect the other user to call the data access interface, but the other user uses technical skills to crack the access permissions of the data access interface and achieves the call to the data access interface.

[0028] 2. The user who owns the data has a business relationship with the other user. The user who owns the data authorizes the other user to call the data access interface, but does not expect the other user to modify the corresponding data without authorization.

[0029] However, once another user has permission to call the data access interface, the data storage system cannot restrict that other user from modifying the data corresponding to the data access interface. If the other user violates the wishes of the user who owns the data and maliciously tampers with the data, the user who owns the data will find it difficult to detect the data tampering. Even if the user who owns the data discovers the data tampering, it will be difficult to provide evidence of the data tampering.

[0030] Therefore, in the technical solution provided in this specification, the data stored by the data storage system can be stored on the blockchain. When a second user (different from the first user) wants to call the data access interface for accessing the data owned by the first user, the data storage system can determine whether the data accessible by the data access interface to be called by the second user is stored on the blockchain. If the determination result is yes, it means that even if the second user tampers with the corresponding data through the data access interface, the first user can still provide evidence of the second user's data tampering behavior based on the original data stored on the blockchain. Therefore, the data access interface can be provided to the second user for calling. If the determination result is no, it means that the second user's behavior of tampering with the corresponding data through the data access interface is difficult for the first user to prove. Therefore, the data access interface can be refused to be provided to the second user for calling.

[0031] The above technical solutions can effectively prevent third parties (users who own the data and third parties outside the data storage system) from tampering with the data in the data storage system.

[0032] The technical solutions provided in this specification are described in detail below with reference to the accompanying drawings.

[0033] Figure 1 This is a flowchart illustrating a control method for a data access interface provided in this specification, including the following steps:

[0034] S100: In response to a second user request to call the data access interface, determine whether the data accessible by the data access interface is stored on the blockchain. If the determination result is yes, then execute step S102; if the determination result is no, then execute step S104.

[0035] S102: Provide the data access interface to the second user for invocation.

[0036] S104: Refuse to provide the data access interface to the second user for invocation.

[0037] Figure 1 The illustrated method is applied to a data storage system. A data storage system can store data sets owned by several users. For ease of description, this paper uses the data set owned by the first user as an example, and defines the second user as any user other than the first user.

[0038] For each piece of data in a dataset, a data storage system can provide a corresponding data access interface, which is equivalent to exposing the data access interface to unspecified users. Each piece of data can have its own dedicated data access interface, with different data types corresponding to different interfaces; alternatively, multiple pieces of data can share the same data access interface.

[0039] At least a portion of the data in the dataset owned by the first user can be stored on the blockchain. The first user can choose, based on their own needs, at least a portion of the data to be stored on the blockchain.

[0040] In some embodiments, for data that needs to be stored on the blockchain, a first user can submit this data to a data storage system for storage and simultaneously store it on the blockchain. In other embodiments, a first user can request the data storage system to store at least a portion of the data on the blockchain.

[0041] For example, the first user can be the administrator of an internet application. This internet application can submit the generated data (such as videos, music, and pictures) to a data storage system for storage, and specify that at least some of the data needs to be stored on the blockchain. In addition to storing all the data submitted by the internet application, the data storage system also needs to store at least some of the data on the blockchain.

[0042] In some embodiments, the data storage system can interface with at least one evidence storage service system, with different evidence storage service systems interface with different blockchains. Furthermore, for communication security purposes, each evidence storage service system can pre-exchange a secure communication certificate with the data storage system, enabling communication between the two systems based on their respective certificates. Each securely communicating evidence storage service system can be registered with the data storage system, forming a list. The data storage system can then provide this list to a first user, who can select at least one system to store data owned by that user.

[0043] In some embodiments, the step of determining that a second user requests to invoke a data access interface may include: receiving an access credential and a signature on the access credential; verifying the signature on the access credential using the public key of the first user; if the signature verification passes and the access credential contains authorization information from the first user authorizing the second user to invoke the data access interface, then determining that the second user requests to invoke the data access interface. Wherein, if the verification passes, it means that the second user's access credential was issued by the first user; if the access credential contains authorization information from the first user authorizing the second user to invoke the data access interface, it means that the second user has obtained authorization from the first user and has the right to request to invoke the data access interface.

[0044] Furthermore, if the signature verification on the access credential fails, it means that the access credential was not issued by the first user and is therefore invalid. The second user does not have the authority to request to call the data access interface, and the data storage system may not recognize the second user's request to call the data access interface.

[0045] Furthermore, even if the signature verification on the access credential passes, if the access credential does not record the authorization information that the first user authorized the second user to call the data access interface, it also means that the second user has not been authorized by the first user and has no permission to request to call the data access interface. The data storage system may also not recognize that the second user requested to call the data access interface.

[0046] After determining that a second user has requested to call the data access interface, the data storage system can respond to the second user's request to call the data access interface and determine what data can be accessed by the data access interface.

[0047] In some embodiments, the data access interface can access only one piece of data. In this case, it is determined whether the data is stored on the blockchain. If the determination result is yes, the data access interface is provided to the second user for invocation; if the determination result is no, the data access interface is refused to be provided to the second user for invocation.

[0048] In some embodiments, the data access interface can access multiple data. In this case, it can be determined whether each data is stored on the blockchain. If the determination result is yes for all of them, the data access interface is provided to the second user for invocation. If any determination result is no, the data access interface can be refused to be provided to the second user for invocation.

[0049] Furthermore, the first user can configure the evidence storage policy for the data they own. In some embodiments, the data storage system can receive configuration information and a signature on the configuration information. The configuration information can be sent by the first user or by other users; however, the configuration information is only valid if the signature on the configuration information is signed by the first user.

[0050] This configuration information may include data identifiers and / or data type identifiers to specify the data that needs to be stored. For example, in an object storage system, its storage structure may include several "buckets," each containing several objects. Different buckets may correspond to different data types. The user can specify the objects to be stored at the "bucket" level or at the "object" level.

[0051] The data storage system can use the first user's public key to verify the signature on the configuration information; if the signature verification passes, an association is established between the first user and the configuration information. In some embodiments, for each piece of data in the data set, it can be determined whether the data matches the configuration information; if so, evidence storage information is constructed based on the data, and the evidence storage information corresponding to the data is submitted to the blockchain. This is equivalent to storing the existing data owned by the first user in the data storage system on the blockchain.

[0052] In other embodiments, for each piece of data subsequently submitted by the first user, the data can be added to the data set, and it can be determined whether the data matches the configuration information. If so, evidence storage information is constructed based on the data, and the evidence storage information corresponding to the data is submitted to the blockchain. It should be noted that the data subsequently submitted by the first user can be modified data submitted to modify the original data. In this way, it is equivalent to storing the incremental data submitted by the first user to the data storage system on the blockchain as well.

[0053] In addition, in some embodiments, the data storage system can be connected to several evidence storage service systems, and the first user can select at least one evidence storage service system. In this way, the data storage system can store the evidence storage information corresponding to the data to the blockchain connected to the evidence storage service system.

[0054] In some embodiments, evidence can be constructed based on this data and the user information of the first user. This is equivalent to also storing the association between this data and the first user on the blockchain.

[0055] In some embodiments, the configuration information may also include extended information types, which can be understood as context fields related to the data. The first user can set multiple different context fields as different extended information types. For example, if the data owned by the first user is copyrighted content, the extended information type corresponding to the copyrighted content may include copyright number, copyright acquisition time, etc. The data storage system can determine the extended information corresponding to the data based on the extended information types included in the configuration information, and construct evidence storage information based on the data and the corresponding extended information.

[0056] In some embodiments, the configuration information may also include evidence preservation method information, used to specify one of the following evidence preservation methods:

[0057] The method of storing evidence data itself is used to encapsulate data into evidence information;

[0058] The method of hashing evidence storage data is used to encapsulate the hash value of the data into the evidence storage information;

[0059] The method of data linking for evidence storage is used to encapsulate the access links created by the data storage system for the data into the evidence storage information;

[0060] The method of storing data privacy is used to store data after adding privacy information specified by the first user (such as the personal privacy of the customers served by the first user) to the data.

[0061] In addition, the method of evidence storage can also include the method of sharing evidence storage data, which is used to not only store the data in a blockchain that is connected to several evidence storage service systems pre-selected by the first user, but also to a blockchain that is connected to other evidence storage service systems that the first user has not pre-selected but temporarily designated.

[0062] The method of evidence preservation may also include the method of sharing the privacy of evidence preservation data, that is, adding the privacy information specified by the first user to the data, and then using the method of sharing evidence preservation data on the data.

[0063] In some embodiments, the data storage system can return the hash value of the evidence storage information corresponding to the data to the first user. In this way, the first user can use the hash value of the evidence storage information to verify the existence of the evidence storage information in the blockchain. Alternatively, the first user can also generate corresponding evidence storage information based on their own data and the configuration information they specified for that data (such as the evidence storage method and extended information), and compare the hash value of the self-generated evidence storage information with the hash value of the evidence storage information returned by the data storage system. If they match, it means that the data storage system has indeed performed evidence storage processing on the data according to the configuration information specified by the first user.

[0064] In other embodiments, the data storage system can save the association between the hash value of the corresponding evidence storage information and the data. Thus, if the data storage system subsequently wants to verify whether the data is stored on the blockchain, it can directly provide the hash value of the evidence storage information associated with the data to the evidence storage service system. The evidence storage service system, based on the hash value sent by the data storage system, can search the connected blockchain to see if the corresponding evidence storage information exists. If it does, it returns a successful verification result to the data storage system.

[0065] In some embodiments, the step of determining whether the data accessible by the data access interface is stored on the blockchain may specifically include: for the data accessible by the data access interface, if it is determined that there is no configuration information matching the data, then it is determined that the data is not stored on the blockchain; if it is determined that there is configuration information matching the data, then based on the data and the configuration information, the storage information corresponding to the data is constructed; and it is determined whether the storage information corresponding to the data is stored in the blockchain. If yes, then it is determined that the data is stored on the blockchain; if no, then it is determined that the data is not stored on the blockchain.

[0066] In some embodiments, after the data access interface is provided to the second user for invocation, the operations performed by the second user on the corresponding data through the data access interface can be recorded. This means that if the second user modifies the corresponding data through the data access result, the data storage system can record this modification, and combined with the original data stored in the blockchain, it can reliably prove the second user's tampering with the data owned by the first user.

[0067] Of course, the data storage system can also record the second user's calls to the data access interface after providing the data access interface to the second user for invocation.

[0068] Figure 2 This is an architecture diagram provided in this specification, including an application for a first user, an application for a second user, a data storage system, and multiple evidence preservation service systems. (For example...) Figure 2As shown, the data generated by the first user's application can be submitted to the data storage system. The data storage system stores the data submitted by the first user's application itself, and also stores the data submitted by the first user's application on a blockchain connected to multiple evidence storage service systems. With the authorization of the first user, the second user's application can initiate a call to the data access interface corresponding to the data owned by the first user. If the data storage system determines that the data accessible by the data access interface has already been stored on the blockchain, it can then provide the data access interface to the second user for use.

[0069] Figure 3 This is a schematic diagram of a data storage method provided in this specification. For example... Figure 3 As shown, the application managed by the first user can submit data to the data storage system. The data storage system checks the configuration information pre-set by the first user to see if there is any configuration information matching the data (i.e., configuration information containing the data identifier or data type identifier corresponding to the data). If so, it confirms that the data needs to be stored on the blockchain. Then, the data storage system can construct the storage information based on the data, the first user's user information, the specified extended information, and the storage method, and request the storage service system to write the storage information to the blockchain. After successful storage, the data storage system can save the association between the data and the hash value of the storage information, and can also return the hash value of the storage information to the application managed by the first user.

[0070] It should be noted that, as Figure 3 As shown, if the data matches more than one configuration piece of information, the configuration piece of information most recently specified by the first user can be used. Additionally, if the data matches both configuration pieces of information containing data type identifiers and configuration pieces of information containing data identifiers, the configuration pieces of information containing data identifiers can be used preferentially.

[0071] Figure 4 This is a schematic diagram illustrating a data access method provided in this specification. For example... Figure 4As shown, the application managed by the second user can request to call the data access interface corresponding to the data owned by the first user. Typically, the second user needs to obtain authorization from the first user beforehand, acquiring an access credential signed by the first user, and then providing this credential to the data storage system. After verifying the access credential, the data storage system can determine the data accessible through the data access interface the second user wants to call. It then reads the configuration information matching this data, and based on this data, the first user's user information, the extended information specified in the configuration information, and the notarization method, it constructs notarization information, essentially using the same algorithm as in the data storage stage to obtain notarization information again. The data storage system can then send the newly obtained notarization information to the notarization service system, requesting the notarization service system to verify whether the notarization information is already in the blockchain. If it is already in the blockchain, the data is considered notarized on the blockchain, and the second user can be permitted to call the data access interface. Simultaneously, a record of the second user calling the data access interface can be generated.

[0072] Figure 5 This is a schematic diagram of a control device for a data access interface provided in this specification, applied to a data storage system. The data storage system stores a data set owned by a first user. For each piece of data in the data set, the data storage system provides a corresponding data access interface. At least a portion of the data in the data set is stored on a blockchain. The device includes:

[0073] The judgment module 501, in response to the second user's request to call the data access interface, determines whether the data accessible by the data access interface is stored on the blockchain; the second user is not the same user as the first user.

[0074] If the judgment result is yes, the processing module 502 will provide the data access interface to the second user for invocation; if the judgment result is no, it will refuse to provide the data access interface to the second user for invocation.

[0075] This specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the functions of a data storage system.

[0076] This specification also provides a computing device, including a memory and a processor; the memory is used to store computer instructions that can be executed on the processor, and the processor is used to implement the functions of a data storage system when executing the computer instructions.

[0077] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0078] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0079] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0080] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0081] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0082] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0083] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0084] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0085] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0086] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0087] In summary, some embodiments disclosed in this specification connect digital goods and digital identities through digital identity technology. The aforementioned digital identity may further include identity authentication information to ensure that transactions of digital goods meet regulatory KYC requirements. In some embodiments, some or all digital identities are fully real-name authenticated, providing a fully real-name authenticated blockchain-based transaction system. Such a system facilitates anti-money laundering and fraud prevention operations, becoming a truly trustworthy transaction system. In some embodiments, combining the recording and verification functions associated with digital goods and digital identities allows for easy recording and verification of transaction elements such as transaction objects and participants, thereby improving the convenience and reliability of transactions. In other embodiments, without relying on digital identities, the transacting party's client can call a smart contract in the blockchain system to create an association table between digital goods and their owners on the chain, and store this association table in the smart contract, thereby reliably recording the ownership of digital goods on the chain.

[0088] The foregoing has described several embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0089] The terminology used in the various embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the various embodiments of this specification. The singular forms “a,” “described,” and “the” as used in the various embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0090] It should be understood that although the terms first, second, third, etc., may be used to describe various information in various embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of various embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0091] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the method embodiments are basically similar to the method embodiments and are therefore described simply; relevant parts can be referred to the descriptions of the method embodiments. The method embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. When implementing the embodiments of this specification, the functions of each module can be implemented in one or more software and / or hardware. Alternatively, some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0092] The above description is merely a preferred embodiment of the various embodiments of this specification and is not intended to limit the various embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the various embodiments of this specification should be included within the protection scope of the various embodiments of this specification.

Claims

1. A control method for a data access interface, applied to a data storage system, wherein, The data storage system stores a data set owned by a first user. For each piece of data in the data set, the data storage system provides a corresponding data access interface. At least a portion of the data in the data set is stored on a blockchain. The method includes: In response to a second user's request to invoke the data access interface, it is determined whether the data accessible by the data access interface is stored on the blockchain; the second user is not the same user as the first user. If the judgment result is yes, then the data access interface is provided to the second user for invocation; if the judgment result is no, then the data access interface is refused to be provided to the second user for invocation. Also includes: Receive configuration information and a signature on the configuration information; the configuration information includes a data identifier and / or a data type identifier, used to specify the data that needs to be stored. The signature on the configuration information is verified using the first user's public key; If the signature verification passes, an association is established between the first user and the configuration information; For each piece of data in the dataset, determine whether the data matches the configuration information. If so, construct evidence storage information based on the data and submit the evidence storage information corresponding to the data to the blockchain.

2. The method as described in claim 1, wherein the step of determining that the second user requests to invoke the data access interface includes: Receive the access credential and the signature on the access credential; The signature on the access credential is verified using the first user's public key; If the signature verification passes and the access credential records the authorization information of the first user authorizing the second user to call the data access interface, then it is determined that the second user requests to call the data access interface.

3. The method of claim 1, further comprising: For each piece of data subsequently submitted by the first user, the data is added to the data set, and it is determined whether the data matches the configuration information. If so, evidence storage information is constructed based on the data, and the evidence storage information corresponding to the data is submitted to the blockchain.

4. The method of claim 3, further comprising: Before receiving the configuration information, determine at least one evidence storage service system selected by the first user from the set of blockchain service systems; Different evidence storage service systems connect to different blockchains; Submit the corresponding evidence information to the blockchain, including: The evidence storage information corresponding to the data is submitted to each evidence storage service system selected by the first user, so that the evidence storage service system stores the evidence storage information corresponding to the data in the blockchain connected to the evidence storage service system.

5. The method as described in claim 4, wherein each evidence storage service system in the blockchain service provider set exchanges a secure communication certificate with the data storage system in advance, so that each evidence storage service system communicates with the data storage system based on each other's secure communication certificates.

6. The method as described in claim 3, comprising constructing evidence storage information based on the data, including: Based on this data and the user information of the first user, evidence storage information is constructed.

7. The method of claim 3, wherein the configuration information further includes an extended information type; Based on this data, evidence storage information is constructed, including: Based on the type of extended information contained in the configuration information, determine the extended information corresponding to the data; Based on this data and its corresponding extended information, evidence storage information is constructed.

8. The method as described in claim 3, wherein the configuration information further includes evidence storage method information, used to specify one of the following evidence storage methods: The method of storing evidence data itself is used to encapsulate data into evidence information; The method of hashing evidence storage data is used to encapsulate the hash value of the data into the evidence storage information; The method of data linking for evidence storage is used to encapsulate the access links created by the data storage system for the data into the evidence storage information; The method of storing data privacy is used to store the data after adding the privacy information specified by the first user.

9. The method of claim 3, further comprising: The hash value of the evidence storage information corresponding to the data is returned to the first user, and / or the association between the hash value of the evidence storage information corresponding to the data and the data is saved.

10. The method as described in claim 3, determining whether the data accessible by the data access interface is stored on the blockchain, includes: If it is determined that there is no configuration information matching the data accessible by the data access interface, then it is determined that the data is not stored on the blockchain. If it is determined that there is configuration information that matches the data, then based on the data and the configuration information, the corresponding evidence storage information is constructed. Determine whether the evidence information corresponding to the data is stored in the blockchain. If yes, then the data is confirmed to be stored in the blockchain; otherwise, the data is confirmed not to be stored in the blockchain.

11. The method of claim 1, further comprising: After providing the data access interface to the second user for invocation, the invocation of the data access interface by the second user is recorded.

12. A data storage system according to any one of claims 1-11.

13. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of any one of claims 1 to 11.

14. A computing device, comprising a memory and a processor; the memory being configured to store computer instructions executable on the processor, the processor being configured to implement the method of any one of claims 1 to 11 when executing the computer instructions.

Images