Data processing method and device

Abstract

The present application provides a data processing method and device, which are applied to a digital object security computing platform, including: obtaining a first target digital object and a processing logic for the first target digital object, the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information about provider target data held by a data provider; receiving first reference information sent by the data provider for the first target digital object, the first reference information is used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data; in response to a processing request for the first target digital object, obtaining the provider target data from a provider database table of the data provider according to the second target digital object, and performing security computing on the provider target data according to the processing logic; and returning the processing result obtained by the security computing to the data demander.

Description

Technical Field

[0001] The present application relates to the field of secure computing, and in particular to a data processing method and device. Background Art

[0002] With the development of society, the degree of informatization is constantly improving, the links between various industries are becoming closer and closer, and the demand for data sharing between industries is becoming stronger and stronger. For example, in the government affairs industry, with the advancement of informatization projects, various provinces and cities have implemented various projects, and the integration and sharing of government affairs information systems have achieved positive results in some areas. Government departments have achieved a certain degree of data sharing and data governance through different data exchange and governance platforms.

[0003] However, due to the sensitivity and isolation of data in the government industry, it is very difficult to share or connect data between departments. There are problems such as difficulty in maintaining data privacy and difficulty in ensuring data security. As a result, many departments are unwilling or afraid to share. Summary of the invention

[0004] In view of this, the present application provides a data processing method and device for processing data.

[0005] Specifically, this application is implemented through the following technical solutions:

[0006] According to a first aspect of the present application, a data processing method is proposed, which is applied to a digital object security computing platform, wherein the digital object security computing platform is used to manage digital objects defined by a data demander and a data provider, respectively. The method comprises:

[0007] Acquire a first target digital object and a processing logic for the first target digital object, wherein the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information of provider target data held by the data provider;

[0008] Receiving first reference information sent by the data provider for the first target digital object, the first reference information being used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data;

[0009] In response to a processing request for the first target digital object, obtaining the provider target data from a provider database table of the data provider according to the second target digital object, and performing security calculation on the provider target data according to the processing logic;

[0010] The processing result obtained by the secure calculation is returned to the data demander.

[0011] According to a second aspect of the present application, a data processing device is proposed, which is applied to a digital object security computing platform, wherein the digital object security computing platform is used to manage digital objects defined by a data demander and a data provider, respectively, and the device includes:

[0012] An acquisition unit, used for acquiring a first target digital object and a processing logic for the first target digital object, wherein the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information of provider target data held by the data provider;

[0013] A receiving unit, configured to receive first reference information sent by the data provider for the first target digital object, wherein the first reference information is used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data;

[0014] a computing unit, in response to a processing request for the first target digital object, acquiring the provider target data from a provider database table of the data provider according to the second target digital object, and performing security computing on the provider target data according to the processing logic;

[0015] The returning unit is used to return the processing result obtained by the security calculation to the data demander.

[0016] According to a third aspect of the present application, an electronic device is provided, including:

[0017] processor;

[0018] a memory for storing processor-executable instructions;

[0019] The processor implements the method described in the embodiment of the first aspect above by running the executable instructions.

[0020] According to a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in the embodiments of the first aspect above are implemented.

[0021] It can be seen from the technical solution provided by the present application that in the present application, data can be securely calculated through the digital object security computing platform, and digital objects are used to express the original data, so that except for the digital object security computing platform and the source of the data, other participants cannot obtain the original data corresponding to the data object, thereby ensuring the security of the original data. Specifically, the data provider can obtain the data demander's processing logic for the data and review it. If the review is passed, the data provider only needs to improve the data demander's processing logic and authorize the corresponding data object permissions, and then submit the improved processing logic to the digital object security computing platform. The platform can process the above data according to the processing logic and return the final processing results to the data demander. In the above process, the data demander cannot obtain the original data provided by the data provider, but can only obtain the processing results, which ensures the security of the data provider's original data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] Figure 1 is a flow chart of a data processing method according to an exemplary embodiment of the present application;

[0024] Figure 2 is a schematic diagram of a network architecture of a digital object secure computing system using an embodiment of the present application;

[0025] Figure 3 is a multi-party interaction flow chart of a data processing method according to an exemplary embodiment of the present application;

[0026] Figure 4 is a schematic diagram of an electronic device according to an exemplary embodiment of the present application;

[0027] Figure 5 It is a block diagram of a data processing device according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0029] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0030] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0031] Next, the embodiments of the present application are described in detail.

[0032] Figure 1 FIG. 1 is a flow chart of a data processing method according to an exemplary embodiment of the present application. Figure 1 As shown, the method is applied to a digital object secure computing platform, which is used to manage digital objects defined by data demanders and data providers respectively. The method may include the following steps:

[0033] Step 102: Obtain a first target digital object and processing logic for the first target digital object. The first target digital object and the processing logic are defined by the data demander. The first target digital object contains information about the provider target data held by the data provider.

[0034] In one embodiment, a digital object security computing system includes a digital object security computing platform and at least one participant. Participants can flexibly create digital objects through the digital object security computing system, and each digital object can be represented by a unique identifier. In addition, participants can also establish a correspondence between the digital objects they manage and the data columns in their own database tables. For example, each digital object can correspond to at least one data column. When the data columns corresponding to the digital object are all the data columns in a certain data table, the digital object is said to correspond to this data table. This application does not limit the correspondence between digital objects and data columns and data tables. It is worth noting that when a digital object directly corresponds to a data table, the digital object directly expresses the information of the data table itself, but does not express the information of all columns in the data table (for a detailed description of digital objects, see the DOA architecture (Digital Object Architecture) in the relevant technology, and this application will not repeat it). The digital object security computing platform is used to manage the digital objects defined by each participant. The digital object security computing platform can interact with multiple participants, such as processing requests sent to it by each participant, managing the permissions of digital objects defined by each party, and helping each participant to share data through data objects. The digital object secure computing platform is a secure third-party platform for all participants. Specifically, the digital object secure computing platform (also referred to as the platform) can be in a secure environment. In the secure environment, data exists in plain text. When the platform needs to interact with participants or other objects outside the secure environment, the platform or the participants need to encrypt the interactive data to ensure the security of the interaction process. In this application, the participants include data demanders and data providers. The data demanders need to process the data owned by the data providers through the secure computing platform to obtain the processing results.

[0035] In one embodiment, the data demander can define a first target digital object, where the first target digital object has not yet established a corresponding relationship with the data in any database table. At the same time, the data demander can also define processing logic for the first target digital object. The processing logic at this time is also represented in the form of a digital object, recording the processing method for the first target digital object. After the digital object security computing platform receives the first target digital object and the above processing logic sent by the data demander, it can forward the first target digital object and the processing logic to the participant (i.e., the data supplier) pointed to by the above attribution information according to the attribution information of the first digital object. The above attribution information represents that the data used in the processing logic defined by the data demander is held by the data provider.

[0036] Further, the data supplier can determine the type, format and other information of the data required in the data processing logic defined by the data demander from the attribute information of the first target digital object; similarly, the data provider can also understand the role of the above data in the processing logic from the above processing logic. In other words, the data provider can know how the data demander wants to process the above data according to the above processing logic. In this embodiment, for the data provider, it can understand what types of data the data demander has a demand for, and can understand the data demander's processing method for this type of data. If the data provider does not want to provide the above type of data or has objections to the above processing method, it can choose not to respond, that is, not to perform subsequent steps. For the data demander, although the processing logic and the first target digital object are disclosed to the data provider, since the first target digital object has not yet established an association with the data column in the database table, and the processing logic is also expressed in the form of a digital object, the data provider does not actually obtain any real data from the data demander, nor can it obtain specific information such as the storage form of the data demander. With the help of the digital object secure computing platform, data demanders can let data providers know what data they need and how to process the required data without disclosing the real data in their own database tables, thereby ensuring the privacy of both data providers and data demanders.

[0037] Step 104: receiving first reference information sent by the data provider for the first target digital object, wherein the first reference information is used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data.

[0038] In one embodiment, if the data provider reviews the first target digital object and the processing logic and believes that it can provide the data of the type required by the data demander (also called the provider target data), then the data provider can create a second target digital object by itself, and establish a corresponding relationship between the second target digital object and the data column where the provider target data is located. Further, the data provider can establish a reference relationship between the second target digital object and the first target digital object, and return the reference information describing the above reference relationship to the digital object security computing platform. The reason why the data provider does not directly provide the provider target data to the digital object security computing platform is that, first, in the scenario of bilateral or multi-party data sharing, the digital object security computing platform, as a trusted third-party platform, maintains the corresponding relationship between the digital objects defined by each participant and the data columns in the database table of each participant, and the digital object security computing platform also has the function of extracting real data according to the corresponding relationship between the digital object and the data column in the database table. Based on the above function, the data provider does not need to directly provide the real provider data to the platform, and the platform can obtain the provider data from the corresponding database according to the above corresponding relationship. Even if the storage location of the provider data changes, it will not affect the process of extracting the provider data by the platform.

[0039] Step 106, in response to the processing request for the first target digital object, obtaining the provider target data from the provider database table of the data provider according to the second target digital object, and performing security calculations on the provider target data according to the processing logic.

[0040] In one embodiment, when the data provider returns the reference information, it means that the data provider agrees to provide the provider's target data to the data demander and process it according to the processing logic defined by the data demander. The above reference information represents that the data type indicated by the first target digital object is represented in the form of a second target digital object at the data provider. Then the digital object security computing platform can determine the provider's target data expressed by the second target digital object based on the second target digital object, and process the provider's target data according to the processing logic defined by the data demander. Specifically, after obtaining the reference information in the previous step, the digital object security computing platform can determine the corresponding data column of the second target digital object in the provider's database table based on the correspondence between the digital object defined by the data provider and the data column in the provider's database table; further, extract the data in the determined data column according to the above correspondence as the provider's target data.

[0041] It is worth noting that if a digital object and several columns in the database table storing the target data establish a corresponding relationship, then even if the data content recorded in the data column associated with the digital object changes, it will not affect the above-mentioned corresponding relationship. It is only when extracting data according to the above-mentioned corresponding relationship that the content of the obtained target data will change. Therefore, the data provider only needs to import the provider's target data required by the data demander into the data column corresponding to the second target digital object before the platform obtains the provider's target data according to the above-mentioned corresponding relationship.

[0042] In one embodiment, the above processing logic may not only involve the provider target data held by the data provider, but may also be related to the third target digital object defined by the data demander to express the demander target data. In other words, the above processing logic may not only include the processing of the provider target data, but also include the processing of the demander target data held by the data demander. In this case, the advantage of expressing the processing logic with digital objects is further revealed: because the data provider can review the processing logic based on the attribute information of the third target digital object without obtaining the target data of the target demander, thereby protecting the privacy of the data demander.

[0043] Furthermore, the data demander can also submit information such as the attributes of the third target digital object to the data provider for review through the digital object security computing platform. The data provider can learn from the attribute information of the third target digital object what types of data the data demander has provided, and what types of data demander's data are involved in the processing logic, so as to better understand the processing logic and make a decision on whether to agree to the data demander to use the provider's target data.

[0044] In one case, if the data provider agrees to provide the provider's target data to the digital object security computing platform, then the platform can determine the demander's target data expressed by the third target digital object based on the third target digital object, and then perform security computing on the provider's target data and the demander's target data according to the processing logic. That is, the provider's target data and the demander's target data are processed according to the processing method expressed by the processing logic. Specifically, the digital object security computing platform can determine the data column corresponding to the third target digital object in the demander's database table based on the corresponding relationship between the digital object defined by the data demander and the data column in the demander's database table; and then extract the data in the determined data column as the demander's target data.

[0045] In another case, the data demander can also use reference to enable the digital object security computing platform to obtain the target data of the demander. Specifically, the data demander can create a fourth target digital object and establish a second reference relationship between the fourth target digital object and the third target digital object. When the data demander provides the fourth target digital object to the data provider for review through the digital object security computing platform, the attribute information of the fourth target digital object can be flexibly configured without being limited by the actual type of the demander's database table corresponding to the third target digital object. In this case, if the data provider passes the review of the processing logic, the digital object security computing platform can associate the third target digital object with the fourth target digital object through the above-mentioned second reference relationship; and then extract the target data of the demander according to the corresponding relationship between the third target digital object and the data column in the library table.

[0046] In one embodiment, the correspondence between the target data of the demander and the third target digital object and the correspondence between the target data of the provider and the second target digital object can be maintained in the form of digital objects at the digital object security computing platform. The digital object security computing platform can add a description of the correspondence in the attribute information of the digital object expressing the correspondence, so as to facilitate the management and storage of the digital object security computing platform. In addition, when the digital object and its corresponding specific data column change, the digital object representing this correspondence does not need to change, and the digital object representing this correspondence and its corresponding specific data column can continue to be referenced.

[0047] Step 108: Return the processing result obtained by the security calculation to the data demander.

[0048] In one embodiment, when the digital object secure computing platform is in a secure environment, when the platform returns the processing result to the data demander, the processing result obtained by the above secure computing can be encrypted before being returned. This application does not limit the encryption method, and symmetric encryption, asymmetric encryption and other methods can be applied to this application. For example, the digital object secure computing platform can use the identity public key of the data demander to encrypt the processing result, and the data demander uses the identity private key to decrypt the processing result to obtain the processing result in plain text.

[0049] It is worth noting that the present application does not limit the specific storage locations of the provider database table and the demander database table. The provider database table can be stored in different databases from the demander database table, or in the same database. When the digital object security computing platform is in a secure environment, the provider database table can be stored together with the demander database table in a secure database within the above-mentioned secure environment. The data provider or data demander can use the ETL tool to encrypt the data that needs to be placed in the secure database and submit it to the database table under its own control in the secure database, and use the digital object security computing system to flexibly configure digital objects for the database table under its own control. Without the authorization of the data provider or the data demander, the digital object security computing platform cannot extract the corresponding data based on the correspondence between the digital object and the data column in the database table.

[0050] It can be seen from the above embodiments that the present application can perform secure computing of data through a digital object secure computing platform, and uses digital objects to express original data, so that except for the digital object secure computing platform and the source of the data, other participants cannot obtain the original data corresponding to the data object, thereby ensuring the security of the original data. Specifically, the data provider can obtain the data demander's processing logic for the data and review it. If the review is passed, the data demander only needs to give the digital object corresponding to the data requested by the data demander to the digital object secure computing platform, and the platform can process the above data according to the processing logic and return the final processing result to the data demander. In the above process, the data demander cannot obtain the original data provided by the data provider, but can only obtain the processing result, which ensures the security of the data provider's original data.

[0051] Figure 2 As shown, it is a schematic diagram of the network architecture of the digital object security computing system using the embodiment of the present application. Figure 2As shown, the digital object security computing system may include a digital object security computing platform 22, a database, a data demander 21, and a data provider 23. Among them, the digital object security computing platform 22 and the database 24 are deployed in the security machine, and the data in the security machine exists in plain text. If the data demander 21 and the data provider 23 need to interact with the digital object security computing platform 22 or the database 24 in the security machine, the data needs to be encrypted. For example, the security processing result of the digital object will be returned to the data demander 21 in the form of ciphertext. The digital object security computing platform 22 contains handle services and back-end management services. The handle service is used to manage, maintain, and parse the digital object itself and manage the authority of the digital object. The back-end management service is used to manage the data transmission, data encryption and decryption of the digital object security computing platform, and associate the digital object with the database table in the database to process and convert the data. In addition, the database in the security machine is used to store the data of the data demander 21 and the data provider 23. The data demander 21 or the data provider 23 can establish a corresponding database table in the database 24 according to their own needs, and encrypt and transmit their own data to the corresponding database table. After obtaining authorization from the data demander 21 or the data provider 23, the digital object security computing platform 22 can extract corresponding data from the database 24 according to the correspondence between the data demander 21 and the data columns in the database table.

[0052] Figure 3 A multi-party interaction flow chart of a data processing method according to an exemplary embodiment of the present application. Figure 3 As shown, the interaction process between the data demander 21, the digital object security computing platform 22 and the data provider 23 includes the following steps:

[0053] Step 302 : the data demander 21 sends the first target digital object and processing logic to the digital object security computing platform 22 .

[0054] In step 304, the digital object security computing platform 22 forwards the first target digital object and the processing logic to the data provider.

[0055] In this step, the data demander can define the first target digital object by itself, and fill in the attribute information of the first target digital object with the type of data held by the data provider 23 that the data demander 21 needs to use in the data processing logic. Of course, the data held by the data demander 21 can also be used in the processing logic, and the data demander 21 can also define the data type held by itself as a third target digital object, and also send it to the data provider 23.

[0056] For ease of understanding, the data demander 21 sends the data provider 23 via the digital object security computing platform 22 in the form of the following:

[0057]

[0058]

[0059]

[0060] Table 1

[0061] In the above table, 86.100 / A10, 86.100 / A1, 86.100 / A2, 86.100 / A3 are the third target digital objects defined by the data demander 21, 86.100 / B, 86.100 / B1, 86.100 / B2, 86.100 / B3 are the identifiers of the first target digital objects defined by the data demander 21, and the identifier of each digital object is unique; the processing logic is the processing method for the data represented by each of the above digital objects defined by the data demander 21. It can be seen that the data demander has not provided any real data to the data provider 23, and the data provider 23 can only know the approximate type of data required by the processing logic from the attribute information of the digital object (i.e., the field description, format, and resource shown in the table).

[0062] Step 306: The data provider 23 reviews the processing logic and the digital object.

[0063] Step 308: The data provider 23 fills in the reference information.

[0064] In step 310 , the data provider 23 returns the reference information to the digital object security computing platform 22 and uploads the corresponding data to the database 24 .

[0065] In the above steps, the data provider 23 can review the processing logic and digital objects shown in Table 1. For example, the data provider 23 can learn from the field description information of the third target digital object defined by the data demander 21 that the data processing process needs to use the three types of data in the offender information table held by the data demander 21, namely, the ID card, name, and illegal behavior record, as well as the three types of data held by the data demander 21, namely, the ID card, medical treatment time, and symptoms. The relevant staff can understand the purpose of the data demander 21 using the above types of data by combining the field description information of each digital object with the processing logic analysis.

[0066] If the data provider 23 believes that the above information can be provided, it can fill in the reference information corresponding to the digital objects 86.100 / B, 86.100 / B1, 86.100 / B2, and 86.100 / B3. Specifically, the data provider 23 can upload the data required by the data demander 21 to the database 24 held by the digital object security computing platform 22 according to the digital object defined by the data demander 21 and the corresponding format requirements, and create a second target digital object by itself, and establish a corresponding relationship between the second target digital object and the data columns where the three types of data, namely, identity card, medical treatment time, and symptoms, are located. Furthermore, the data provider 23 can fill in the identifier of the second target digital object in the corresponding reference information. And return the above reference information to the digital object security computing platform 22.

[0067] For example, the above Table 1 filled in by the data provider 23 can be represented by Table 2:

[0068]

[0069]

[0070]

[0071] Table 2

[0072] In Table 2, 86.200 / B, 86.200 / B1, 86.200 / B2, and 86.200 / B3 are the second target digital objects filled in by the data provider 23 .

[0073] It is worth noting that the digital object with the identifier 86.100 / A in Table 1 and Table 2 is filled with reference information by the data demander 21 because the data demander 21 may not want to disclose the types of all data columns in the original offender information table, but the field description information of the digital object with the identifier 86.100 / A is filled in when it was created before, which may contain information of all data types; in order not to repeatedly change the field description information of the original digital object, 86.100 / A10 can be used as a reference to 86.100 / A, and only the content that the data demander 21 wants to disclose is filled in the field description of 86.100 / A, so as to further protect the privacy of the data demander 21. Of course, the data demander 21 can also not fill in the reference information, as shown in 86.100 / A1, 86.100 / A2, and 86.100 / A3, which will not affect the implementation of this application.

[0074] Step 312: the data demander 21 submits a request to execute processing logic to the digital object security computing platform 22.

[0075] Step 314: the digital object security computing platform 22 performs processing according to the processing logic.

[0076] In the above steps, since the first, second, and third target digital objects have been configured by the corresponding participants with corresponding data columns in the database table, the digital security computing platform 22 can determine the data columns to be used based on the corresponding relationship between the digital objects and the data columns in the database table in response to the request for executing the processing logic sent by the data demander 21, and then extract the corresponding data from the above determined data columns. Furthermore, the digital security computing platform 22 can also parse the processing logic and process the extracted data according to the above processing logic to generate a processing result.

[0077] In step 316, the digital object security computing platform 22 may decrypt the processing result obtained in the above steps.

[0078] In step 318 , the digital object security computing platform 22 returns the encrypted processing result to the data demander 21 , so that the data demander 21 can decrypt the processing result.

[0079] Corresponding to the above method embodiment, this specification also provides an embodiment of a device.

[0080] Figure 4 is a schematic diagram of a data processing electronic device according to an exemplary embodiment of the present application. Figure 4 At the hardware level, the electronic device includes a processor 402, an internal bus 404, a network interface 406, a memory 408, and a non-volatile memory 410, and may also include hardware required for other services. The processor 402 reads the corresponding computer program from the non-volatile memory 410 into the memory 408 and then runs it, forming a data processing device at the logical level. Of course, in addition to the software implementation, this application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0081] Figure 5 is a block diagram of a data processing device according to an exemplary embodiment of the present application. Figure 5 The device is applied to a digital object security computing platform, which is used to manage digital objects defined by data demanders and data providers respectively. The device includes an acquisition unit 502, a receiving unit 504, a computing unit 506, and a returning unit 508, wherein:

[0082] The acquisition unit 502 is used to acquire a first target digital object and processing logic for the first target digital object, wherein the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information of provider target data held by the data provider.

[0083] The receiving unit 504 is configured to receive first reference information sent by the data provider for the first target digital object, wherein the first reference information is used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data.

[0084] The computing unit 506, in response to the processing request for the first target digital object, obtains the provider target data from the provider database table of the data provider according to the second target digital object, and performs security calculation on the provider target data according to the processing logic.

[0085] The returning unit 508 is used to return the processing result obtained by the security calculation to the data demander.

[0086] Optionally, the calculation unit 506 is specifically configured to: determine the data column corresponding to the second target digital object in the provider's database table according to the correspondence between the digital object defined by the data provider and the data column in the provider's database table;

[0087] The data in the determined data column is extracted as the provider target data.

[0088] Optionally, the processing logic is further related to a third target digital object defined by the data demander, and the third target digital object corresponds to the demander target data held by the data demander; the calculation unit 506 is specifically used for:

[0089] The demander target data is acquired from the demander database table of the data demander according to the third target digital object, and the security calculation is performed on the provider target data and the demander target data according to the processing logic.

[0090] Optionally, the acquiring the demander target data from a demander database table of the data demander according to the third target digital object includes:

[0091] Determine the data column in the demander's database table corresponding to the third target digital object according to the corresponding relationship between the digital object defined by the data demander and the data column in the demander's database table;

[0092] The data in the determined data column is extracted to serve as the demand-side target data.

[0093] Optionally, determining the data column in the demander's database table corresponding to the third target digital object according to the correspondence between the digital object defined by the data demander and the data column in the demander's database table includes:

[0094] Determine a second reference relationship defined by the data demander for the third target digital object, wherein the second reference relationship is used to associate the third target digital object with a fourth target digital object defined by the data demander for the demander's target data;

[0095] The demander target data is extracted according to the correspondence between the fourth target digital object and the data column in the library table.

[0096] Optionally, the corresponding relationship is maintained in the digital object security computing platform in the form of a digital object.

[0097] Optionally, the returning unit 508 is specifically used to: encrypt the processing result obtained by the security calculation and return it to the data demander.

[0098] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0099] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0100] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory including instructions. The instructions may be executed by a processor of a data processing device to implement any of the methods described in the above embodiments. For example, the method may include:

[0101] Acquire a first target digital object and processing logic for the first target digital object, wherein the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information about provider target data held by the data provider; receive first reference information sent by the data provider for the first target digital object, wherein the first reference information is used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data; in response to a processing request for the first target digital object, acquire the provider target data from a provider database table of the data provider according to the second target digital object, and perform security calculations on the provider target data according to the processing logic; and return the processing result obtained by the security calculation to the data demander.

[0102] The non-temporary computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc., and the present application does not limit this.

[0103] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: Applied to a digital object secure computing platform, the digital object secure computing platform is used to manage digital objects defined by a data demander and a data provider respectively, the method comprises: Acquire a first target digital object and a processing logic for the first target digital object, wherein the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information of provider target data held by the data provider; Receiving first reference information sent by the data provider for the first target digital object, the first reference information being used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data; In response to a processing request for the first target digital object, obtaining the provider target data from a provider database table of the data provider according to the second target digital object, and performing security calculation on the provider target data according to the processing logic; The processing result obtained by the secure calculation is returned to the data demander.

2. The method according to claim 1, characterized in that: The acquiring the provider target data from the provider database table of the data provider according to the second target digital object comprises: Determine the data column in the provider's database table corresponding to the second target digital object according to the corresponding relationship between the digital object defined by the data provider and the data column in the provider's database table; The data in the determined data column is extracted as the provider target data.

3. The method according to claim 1, characterized in that The processing logic is also related to a third target digital object defined by the data demander, the third target digital object corresponding to the demander target data held by the data demander; The performing secure calculation on the provider target data according to the processing logic comprises: The demander target data is acquired from the demander database table of the data demander according to the third target digital object, and the security calculation is performed on the provider target data and the demander target data according to the processing logic.

4. The method according to claim 3, characterized in that The acquiring the demander target data from the demander database table of the data demander according to the third target digital object comprises: Determine the data column in the demander's database table corresponding to the third target digital object according to the corresponding relationship between the digital object defined by the data demander and the data column in the demander's database table; The data in the determined data column is extracted to serve as the demand-side target data.

5. The method according to claim 4, characterized in that The step of determining the data column in the demander's database table corresponding to the third target digital object according to the correspondence between the digital object defined by the data demander and the data column in the demander's database table comprises: Determine a second reference relationship defined by the data demander for the third target digital object, wherein the second reference relationship is used to associate the third target digital object with a fourth target digital object defined by the data demander for the demander's target data; According to the correspondence between the third target digital object and the data column in the data demander's library table, the provider's target data is extracted.

6. The method according to any one of claims 2, 4 or 5, characterized in that: The corresponding relationship is maintained in the form of a digital object at the digital object security computing platform.

7. The method according to claim 1, characterized in that The returning the processing result obtained by the secure calculation to the data demander includes: The processing result obtained by the secure calculation is encrypted and returned to the data demander.

8. A data processing device, characterized in that: Applied to a digital object secure computing platform, the digital object secure computing platform is used to manage digital objects defined by a data demander and a data provider, respectively, the device comprises: An acquisition unit, used for acquiring a first target digital object and a processing logic for the first target digital object, wherein the first target digital object and the processing logic are defined by the data demander, and the first target digital object contains information of provider target data held by the data provider; A receiving unit, configured to receive first reference information sent by the data provider for the first target digital object, wherein the first reference information is used to associate the first target digital object with a second target digital object defined by the data provider for the provider target data; a computing unit, in response to a processing request for the first target digital object, acquiring the provider target data from a provider database table of the data provider according to the second target digital object, and performing security computing on the provider target data according to the processing logic; The returning unit is used to return the processing result obtained by the security calculation to the data demander.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 7 by running the executable instructions.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images