A data asset usage control method, client and intermediate service platform

Abstract

The present application relates to the field of data processing technology, and discloses a method for controlling the use of data assets, the method comprising: a data provider and a data user perform user registration and identity authentication through their respective clients; the data user and the data provider enter into a smart contract; the data user's client performs a use environment scan, generates a white list of processes that are allowed to access or use control data assets, and after confirming the processes in the white list, the data provider's client sends AAS‑DA‑user and pre-processed data assets to the data user's client; during the use of the data assets, the data user's client confirms whether one or more processes that are about to call the data assets have the authority based on the processes in the white list, and when the change of the data assets reaches the boundary conditions of the smart contract or violates the constraints, the data assets are terminated and / or destroyed through AAS‑DA‑user and AAS‑DA‑public.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, for example, to a method for controlling the use of data assets, a client, and an intermediate service platform. Background Art

[0002] At present, with the deepening of the digital transformation of the manufacturing industry, data as a new production factor is bound to play a greater role. As stated in the Data Security Law, ensuring the orderly flow of data, cultivating the data trading market, and strengthening the protection of important data are becoming necessary tasks for the "last mile" of data value. As an information resource, the two key characteristics of data as an asset are that it can bring economic benefits to enterprises and can measure costs and benefits. Compared with traditional tangible assets and intangible assets, data assets are non-physical, dependent, diverse, processable, value-volatile, multiple derivatives, shareable, and zero-cost replicable.

[0003] In the process of implementing the embodiments of the present disclosure, it is found that there are at least the following problems in the related art:

[0004] Due to the many characteristics of data assets, data assets have problems such as poor quality, difficulty in data interoperability, high acquisition costs, difficulty in ensuring security, and complex ownership confirmation and valuation transactions. A technical system for data sharing, circulation, trading and security protection has not yet been formed, which has led to bottlenecks in the realization of data value. Summary of the invention

[0005] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0006] The disclosed embodiments provide a method, client, intermediate service platform and storage medium for controlling the use of data assets, so as to manage and constrain data assets, give full play to the strategic resource role and innovation engine role of data, and promote the value of data elements.

[0007] In some embodiments, the data asset usage control method is applied to a client as a data provider, a client as a data user, and an intermediate service platform as an intermediate service provider, and the method includes:

[0008] The data provider and the data user register and authenticate their identities through their respective clients. The authenticated data provider registers and authenticates the data asset active management system AAS-DA to the intermediate service platform through the data provider's client.

[0009] The data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the data provider's client, so that the data user and the data provider can reach a smart contract;

[0010] The client of the data user scans the usage environment and generates a whitelist of processes that are allowed to access or use the control data assets. After confirming the processes in the whitelist, the client of the data provider sends the AAS-DA-user and the pre-processed data assets to the client of the data user.

[0011] During the use of data assets, the data user's client confirms whether one or more processes that are about to call the data assets have permission based on the processes in the whitelist, and terminates and / or destroys the data assets through AAS-DA-user and AAS-DA-public when the change of data assets reaches the boundary conditions of the smart contract or violates the constraints.

[0012] In some embodiments, the client is characterized by comprising a processor and a memory storing program instructions, and the processor is configured to execute the data asset use control method as described in the present application when running the program instructions;

[0013] Wherein, the client is configured as follows:

[0014] Execute data asset active management system AAS-DA management, identity registration and management, smart contract management, process use control, log storage, clearing docking and communication functions;

[0015] Deployed on-premises or on a private cloud, and placed in a trusted and secure environment at the hardware, system, and / or software layers.

[0016] In some embodiments, the intermediate service platform is characterized in that it includes a processor and a memory storing program instructions, wherein the processor is configured to execute the data asset use control method as described in the present application when running the program instructions;

[0017] Wherein, the intermediate service platform is configured as follows:

[0018] Perform identity authentication, resource directory management, supply and demand docking, smart contract management, log storage, liquidation audit and service evaluation functions;

[0019] Deployed on a public or private cloud and placed in a trusted and secure environment at the hardware, system, and software layers.

[0020] In some embodiments, the storage medium stores program instructions, and when the program instructions are run, they execute the data asset usage control method described in the present application.

[0021] The data asset usage control method, client, intermediate service platform, and storage medium provided in the embodiments of the present disclosure can achieve the following technical effects:

[0022] This application uses AAS-DA to control the loading and use of data assets between the client as the data provider, the client as the data user, and the intermediate service platform as the intermediate service provider, so as to keep the data sovereignty in the hands of the data provider, realize the data assets are available but invisible, controllable and measurable, access permission control and burn after use, solve the problems of poor quality of data assets, difficulty in data intercommunication, high acquisition cost, difficulty in ensuring security, complex ownership confirmation and valuation transactions, and form a technical system for data sharing, circulation, transaction and security protection.

[0023] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0025] Figure 1 It is a functional architecture diagram of AAS-DA provided by this application;

[0026] Figure 2 It is a flowchart of a data asset management method provided by this application;

[0027] Figure 3 It is a flowchart of another data asset management method provided by this application;

[0028] Figure 4 It is a flowchart of another data asset management method provided by this application;

[0029] Figure 5 It is a flowchart of another data asset management method provided by this application;

[0030] Figure 6 It is a flowchart of another data asset management method provided by this application;

[0031] Figure 7 It is a flowchart of another data asset management method provided by this application;

[0032] Figure 8 It is a flowchart of another data asset management method provided by this application;

[0033] Fig. 9 It is a schematic diagram of the system structure of an AAS-DA provided by this application;

[0034] Fig.10 It is a flowchart of a method for controlling the use of data assets provided by this application;

[0035] Fig.11 It is a flowchart of another data asset use control method provided by the present application;

[0036] Fig.12 It is a flowchart of another data asset use control method provided by the present application;

[0037] Fig.13 It is a flowchart of another data asset use control method provided by the present application;

[0038] Fig.14 It is a flowchart of another data asset use control method provided by the present application;

[0039] Fig.15 It is a flowchart of another data asset use control method provided by the present application;

[0040] Fig.16 It is a flowchart of another data asset use control method provided by the present application;

[0041] Fig.17 is a schematic diagram of a computing device provided by the present application. DETAILED DESCRIPTION

[0042] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0043] The terms "first", "second", etc. in the specification and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so as to describe the embodiments of the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0044] Unless otherwise stated, the term "plurality" means two or more.

[0045] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0046] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0047] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0048] First, the technical terms involved in this application are explained:

[0049] AAS-DA (Active Administration System-Data Asset): is an active data asset management system that manages and controls the use of data assets throughout their life cycle.

[0050] DA (Data-Asset): refers to data assets, used to identify a data asset.

[0051] API (Application Programming Interface) refers to the connection interface, and in this application it refers to the interface in the data asset active management system AAS-DA.

[0052] In related technologies, data assets have many characteristics and also face many challenges. According to PwC's definition, compared with traditional tangible and intangible assets, data assets are non-physical, dependent, diverse, processable, and volatile in value. On this basis, Everbright Bank and Liaowang Think Tank have added multiple derivatives, shareability, and zero-cost replicability. Specifically:

[0053] Non-practicality: It does not have a physical form and relies on a physical carrier to exist; it does not wear out or consume due to use; it can be used indefinitely during its existence.

[0054] Dependence: must be stored in a certain medium; can exist in multiple media at the same time in different forms.

[0055] Diversity: diverse forms of expression; diverse forms of integration; uncertain ways of use.

[0056] Value volatility: Value is affected by many different factors; including technology, capacity, value density, application business model, etc.

[0057] Processability: can be maintained, updated, supplemented, and added; can be deleted, merged, grouped, and de-redundant; can be analyzed, refined, and mined, etc.

[0058] Multiple derivability: refers to the fact that the same data subject can be processed at multiple levels and dimensions, thereby deriving different degrees of data value, conducting multi-level and multi-dimensional data asset potential value mining, and enriching data assets.

[0059] Sharability: data assets can be exchanged, transferred and used indefinitely, and their sharing can maximize the value of data assets;

[0060] Zero-cost reproducibility: This means that the cost of data assets mainly lies in the early stages of data reading and research and development. Therefore, the cost of initial data assets is extremely high, but the marginal cost of subsequent replication and sharing tends to zero.

[0061] Therefore, the many characteristics of data assets have largely led to difficulties in ownership confirmation and valuation transactions. This application aims to manage and restrict the above-mentioned characteristics of data assets.

[0062] At the same time, the two key features of data as an asset are that it can bring economic benefits to the enterprise and that costs and benefits can be measured. The main reasons for the bottlenecks in the value of data include poor quality, difficulty in data intercommunication, high acquisition costs, and difficulty in ensuring security. Data assets need to be managed from the following dimensions, including:

[0063] Data standards management: Normative constraints to ensure the consistency and accuracy of internal and external use and exchange of data.

[0064] Metadata management: abstract information about data, trace data, and explore the relationships between data.

[0065] Data quality management: Improve data quality and enhance the level of data applications and services.

[0066] Data security management: divide data security levels, formulate data security management specifications, and achieve "manageable before, controllable during, and traceable after".

[0067] Data value management: data cost management and data revenue management to optimize and maximize the release of data value.

[0068] Data sharing management: Release the internal and external value of data through internal data sharing, external data circulation, and external opening.

[0069] It can be seen that the problems and challenges faced by data assets in sharing include transparency, accessibility, standardization, security and data integrity. Specifically:

[0070] Transparency: refers to the openness of all parties involved in the sharing of data assets to provide all the information required to successfully deliver the data sharing partnership.

[0071] Accessibility: refers to the ability of parties to access the data they need, when they need it.

[0072] Standardization: refers to the use of consistent legal, technical and other measures by all stakeholders in the data sharing process.

[0073] Security and Data Integrity: refers to the implementation of measures and mechanisms designed to securely protect information and data to achieve a secure environment for data sharing.

[0074] To this end, combined Figure 1 As shown, the present application provides a data asset active management system AAS-DA to manage the entire life cycle of data assets, as well as executive supervision, control and management during use. Among them, each data asset has a twin AAS-DA to match it, thereby upgrading the data asset from a passive asset to an active asset. AAS-DA can define, configure and update the attribute information of data assets, record the entire life cycle information, and perform the highest priority operations on data assets, including but not limited to desensitization, encryption, termination and destruction. When data assets are processed, AAS-DA can record the processing process and terminate and / or destroy the data assets when they do not meet the data asset security requirements and other constraints. When a data asset is copied, a new AAS-DA will be generated accordingly, and the AAS-DA of the copied data asset and the AAS-DA of the original data asset will be associated.

[0075] Optionally, the AAS-DA of the present application supports all types of data assets, including but not limited to streaming data, event data, engineering drawings, videos, algorithms, machine learning models or knowledge graphs, etc.

[0076] Optionally, in order to ensure the transparency of data asset sharing, circulation and transactions and to make all stakeholders aware of relevant information, AAS-DA can be divided into AAS-DA-supplier, AAS-DA-user and AAS-DA-public according to the ownership of different stakeholders. The three AAS-DAs of the same data asset are interrelated and can be merged when necessary. Among them, AAS-DA-supplier has the highest authority and can read all contents in AAS-DA-user and AAS-DA-public. The contents specified by AAS-DA-user and AAS-DA-public must be a subset of AAS-DA-supplier.

[0077] Combination Figure 1 As shown, the functional architecture of the data asset active management system AAS-DA of this application consists of "identity tags" and "subjects". Among them, the identity tag is the global unique identifier of the data asset and AAS-DA; the subject includes: the full life cycle management component of the data asset, the control management component, the log evidence management component and the interface management component and their corresponding attributes.

[0078] In an embodiment of the present application, the full life cycle management component is configured to perform full life cycle management on various subject attributes of data assets, and various subject attributes include data sovereignty, data history, data quality, data type, data level, data standard, data value, data sharing and contract attributes, so as to achieve the management of data sovereignty, data history, data quality, data type, data level, data standard, data value, data sharing and smart contracts of data assets. The detailed content of each attribute structure is shown in Table 1:

[0079] Table 1: Detailed table of attributes of data assets throughout their life cycle

[0080]

[0081]

[0082] In this way, the full life cycle management of data assets can be better achieved.

[0083] In an embodiment of the present application, the control management component is configured to manage the use process of data assets, which specifically includes attributes such as permission management, access control, contract settings, usage control, usage mode, collaboration mode, and usage environment security scan, so as to manage the permissions, access control, contract settings, usage control, usage mode, collaboration mode, and usage environment security scan of data assets.

[0084] Specifically, permission management implements the control of user access / use of data assets, and controls users to access and only access the data assets they are authorized to access according to security rules or security policies. Permission management includes two parts: user identity authentication and authorization, referred to as authentication and authorization. Users who need to access / use controlled data assets must first undergo identity authentication. After the authentication is passed, the user has the access / use rights to the resource and can access / use it.

[0085] Access control includes settings, operations, monitoring, and interruptions. Settings mainly involve setting access control modes, subjects, behaviors, resources, and environments. Access control modes generally take the following forms: autonomous access control, command access control, role access control, attribute access control, or other types of access control; subjects include server administrators, data holders, contracted data users, uncontracted data users, and other role subjects; behaviors include reading, writing, copying, deleting, and other behaviors; resources are mainly references to data asset attributes in the full life cycle management of data assets; environment refers to the time, location, and other environmental factors when data transactions occur. Interruptions are mainly divided into active interruptions and passive interruptions.

[0086] The contract setting mainly involves setting contract terms such as Value (hash value, DNA / ID card of data), Address (connecting different clients), State (input: target state, such as usage time, number of times, etc.) and Function (output: executable strategy) after an agreement is reached between the data provider and the data user.

[0087] Usage control mainly monitors the use process of data assets and identifies abnormal situations according to the relevant requirements in the contract settings, as well as suspends the call of data assets and realizes the destruction of data assets. The data usage process is monitored in real time through the monitor. When the user reaches a specific State (reaching the number of times, termination by the provider, or breach of contract by the user), the executable strategy in the contract setting-Function is called by the executor to realize the destruction, suspension, and pause of data assets.

[0088] Optionally, the usage modes generally include the following: regular use, privacy computing mode, federated learning mode, encryption mode, and other custom modes.

[0089] The collaboration mode includes the merged collaboration mode and the associated collaboration mode. Two / multiple AAS-DA-suppliers that open the collaboration mode will achieve synchronous management of data assets during the use of data assets.

[0090] The security scan of the usage environment is mainly carried out by AAS-DA-user before the data assets reach the data user, based on the requirements of the smart contract, to perform a security scan on the software layer and system layer of the usage environment, and to mark the software that meets the requirements of the smart contract for security.

[0091] The detailed contents of the attribute structure of the data asset control management component are shown in Table 2:

[0092] Table 2: Detailed table of attributes for data asset management

[0093]

[0094]

[0095] In this way, the use and control of data assets can be better achieved.

[0096] In an embodiment of the present application, the log evidence management component is configured to manage various types of logs generated during the use of the data asset active management system, wherein the various types of logs mainly include internal logs, data operation logs, and collaborative logs with other data asset management systems. Specifically, it includes but is not limited to the operations of various functional components in the AAS-DA-supplier, the operations of the AAS-DA-supplier on data assets, the operations on data assets sent by the AAS-DA-user to the AAS-DA-supplier, the operations on replicated data or sub-data sent by other related AAS-DAs to the AAS-DA-supplier, and the collection of these operation results in order of time. Each log file consists of log records, and each log record describes a separate system event.

[0097] Normally, the system log is the local log of the AAS-DA-supplier that can be directly read by the data provider, which includes a timestamp and a message or other information specific to the subsystem. The usage log is the operation log of the data asset sent by the AAS-DA-user to the AAS-DA-supplier and AAS-DA-public during the operation of the data user. It generally needs to be stored on the blockchain for subsequent liquidation, auditing, supervision, etc.

[0098] In an embodiment of the present application, the interface management component is configured to manage the communication interface of the data asset active management system. Specifically, the interface management component mainly manages the communication interface between at least two data asset active management systems, and the communication interface between the data asset active management system and the data assets.

[0099] The data asset active management system provided by the embodiment of the present disclosure realizes the full life cycle management of data assets and effective governance of data assets by loading the full life cycle management components, control management components, log evidence management components and interface management components of identity tags and subjects and their attribute functions, solves the problems of poor quality of data assets, difficulty in data intercommunication, high acquisition cost, difficulty in ensuring security, and complex ownership confirmation and valuation transactions, and forms a technical system for data sharing, circulation, transaction and security protection.

[0100] In practical applications, such as Figure 2 As shown, the present application provides a data asset management method, which is applied to a data asset active management system AAS-DA, wherein the data asset active management system AAS-DA is divided into AAS-DA-supplier, AAS-DA-user and AAS-DA-public, and the method includes:

[0101] Step 201: After the data asset is formed, the data provider creates an AAS-DA-supplier corresponding to the data asset and initializes the configuration of the data asset in the AAS-DA-supplier.

[0102] Step 202: The data provider saves the data asset information to be disclosed in the AAS-DA-supplier as the corresponding AAS-DA-public and uploads it to the intermediate service provider. The intermediate service provider realizes the information release of the AAS-DA-supplier through the AAS-DA-public.

[0103] Step 203: The data user reads the data asset information disclosed in AAS-DA-public and enters into a smart contract with the data provider through AAS-DA-public.

[0104] Step 204: The data provider saves the AAS-DA-supplier as AAS-DA-user, and sends the AAS-DA-user and the pre-processed data assets to the data user.

[0105] Step 205: AAS-DA-user monitors the data asset usage process of the data user according to the smart contract and records all processing operation information of the data assets.

[0106] Step 206: When the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, AAS-DA-user terminates the use of and / or destroys the data assets of the data user.

[0107] By adopting the data asset management method provided in the embodiment of the present disclosure, the full life cycle management of data assets is realized among data providers, data users and intermediate service providers through AAS-DA, and the data sovereignty is kept in the hands of data providers. The data assets can be available but invisible, controllable and measurable, with access rights controlled and destroyed after use. The problems of poor quality of data assets, difficulty in data intercommunication, high acquisition cost, difficulty in ensuring security, complex ownership confirmation and valuation transactions are solved, and a technical system for data sharing, circulation, transaction and security protection is formed.

[0108] In the embodiments of the present application, Figure 3 As shown, the initialization configuration of data assets in AAS-DA-supplier includes:

[0109] Step 301: Generate the sovereignty initial information of the data asset in the AAS-DA-supplier, wherein the sovereignty initial information includes the ownership information, time information and location information of the data asset.

[0110] In the embodiment of the application, after the data asset is generated, the sovereign initial information of the data asset is generated in the AAS-DA-supplier, including the ownership, time, location and other information of the data asset generation, to facilitate data rights confirmation.

[0111] Step 302: Define, set and update various subject attributes of data assets through AAS-DA-supplier.

[0112] In the embodiments of the application, various attributes of data assets can be defined, set and updated through AAS-DA-supplier, including data type, standards, specifications and laws and regulations followed by data assets, quality level, security level requirements, etc.

[0113] Step 303: When a data asset is copied or sub-data is generated, the association is performed through the respective AAS-DA-supplier.

[0114] In the embodiments of the application, when data assets are copied or sub-data are generated, they can be associated through their respective AAS-DAs to facilitate traceability.

[0115] Step 304: Desensitize or encrypt data assets through AAS-DA-supplier.

[0116] In the embodiment of the application, before the data assets are used, the AAS-DA-supplier can desensitize the data assets and encrypt the data according to the encryption algorithm requirements of the country and the enterprise.

[0117] In addition, during the use of data assets, AAS-DA-user records all processing operation information for data assets and provides feedback to AAS-DA-supplier in real time or afterwards. After learning about the processing status of data assets, AAS-DA-supplier can actively issue termination / destruction instructions to AAS-DA-user, and AAS-DA-user can call the operation script to realize the termination / destruction of data assets; and AAS-DA can manage the physical carriers and storage media of data assets.

[0118] In this way, data providers can better control and protect data assets.

[0119] In the embodiments of the present application, Figure 4 As shown, the intermediate service provider uses AAS-DA-public to implement the information release of AAS-DA-supplier, including:

[0120] Step 401: The intermediate service provider generates a resource directory based on various subject attributes of AAS-DA-public to implement a centralized management mode or a distributed management mode of data assets.

[0121] In the embodiment of the application, the resource directory mainly includes the names of various types of resources and their metadata descriptions. The intermediate service platform supports the sharing and trading of the following three types of resources: one is the data asset class, including but not limited to streaming data, event data, CAD drawings, videos, algorithms, models, digital twins, knowledge graphs, APPs, API calls, etc. The metadata of the data asset class is stored in the full life cycle management component of the data asset of the corresponding AAS-DA-supplier; the second is the IT infrastructure class, including but not limited to cloud computing, edge computing, computing resources, communication resources, etc.; the third is the trusted environment solution class, including but not limited to trusted environment solutions at the hardware layer, system layer and software layer. Certified AAS-DAs and resources will be included in the resource directory for management.

[0122] The data provider saves the information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediary service provider through the data provider. The AAS-DA-public that has been reviewed and approved by the intermediary service platform is included in the resource directory.

[0123] Step 402: The data user searches for data assets that meet the requirements by accessing the resource directory of the intermediate service provider.

[0124] Step 403: The intermediate service provider pushes data assets to the data user according to the supply status of the data assets in the resource directory.

[0125] In an embodiment of the application, data users can access the resource directory of the intermediate service provider to query data assets and other resources that meet their requirements. Data users can also subscribe to resource directory updates, or fill in the requirements for data assets and other resources of interest. The intermediate service provider can make precise push notifications based on the supply of data assets and other resources.

[0126] In this way, this application does not need to centralize the data assets themselves to the intermediate service provider, but only needs to manage AAS-DA-public and generate a resource directory based on the various attribute information in AAS-DA-public, so as to realize the distributed management of data assets and the centralized management of AAS-DA, reduce the risks of data assets, and increase the willingness of data providers to share data assets.

[0127] In the embodiments of the present application, Figure 5 As shown, the data user reads the data asset information disclosed in AAS-DA-public and develops a smart contract with the data provider through AAS-DA-public, including:

[0128] Step 501: A data user initiates an invitation to one or more data providers that meet its needs.

[0129] Step 502: The data provider who accepts the invitation will negotiate with the data user on the cooperation intention of data assets and write the negotiated content into AAS-DA-public.

[0130] Step 503: Configure the use process of data assets in AAS-DA-public and store logs.

[0131] In an embodiment of the present application, the data user initiates an invitation to one or more data providers that meet its needs. The data provider that accepts the invitation will negotiate with the data user on the cooperation intention of the data asset, and write the negotiated content into the contract management attribute of the full life cycle management component of the data asset of AAS-DA-public. At the same time, in the control management component of the data asset of AAS-DA-public, permission management, access control, contract settings, usage control, usage mode, collaborative mode attributes, etc. are configured. At the same time, the time when the smart contract is reached and the information of the two parties to the transaction will be recorded in the log storage of AAS-DA-public.

[0132] In the embodiments of the present application, Figure 6 As shown, the AAS-DA-user monitors the data asset usage process of the data user according to the smart contract and records all processing operation information of the data assets, including:

[0133] Step 601: AAS-DA-user performs a security scan on the media and environment where the data assets will be stored and used according to the requirements of the usage environment in the smart contract.

[0134] In an embodiment of the present application, the present application can be scanned by the AAS-DA-user for the usage environment: according to the settings about the usage environment in the control management component of the data asset - usage control, the AAS-DA-user will call the control management component of the data asset - the usage environment security scanning function, perform a security scan on the software layer, system layer and hardware layer of the usage environment, and perform security marking on the software that meets the requirements of the smart contract. The software that passes the security marking will be included in the whitelist of access control or usage control in the control management component of the data asset. The AAS-DA-user will feed back the environmental security scan results to the AAS-DA-supplier through the client of the data user. After the AAS-DA-supplier data asset control management component - usage control approves it, the data user will be allowed to access the pre-processed data assets.

[0135] Optionally, according to the provisions of the control management component-contract setting of the AAS-DA-supplier data asset, the AAS-DA-supplier will pre-process the data asset through the usage mode of the control management component of the data asset, including but not limited to desensitization, encryption, generation of calculation factors, etc. If "regular use" in the usage mode is selected, the data asset will be sent to the data user in plain text. If the data usage process involves multi-party collaboration, such as multi-party privacy computing, federated learning, etc., the collaborative mode of the control management component of the data asset will also be set. Two or more AAS-DA-suppliers that turn on the collaborative mode will achieve synchronous management of data assets during the use of data assets.

[0136] Step 602: Confirm the permissions of one or more processes that are about to call the data asset by reading the whitelist of access control or use control in AAS-DA-user.

[0137] In an embodiment of the present application, the permission of one or more processes that call data assets is initiated to AAS-DA-user through the data user, and the permission of one or more processes that are about to call data assets is confirmed by reading the white list of access control or use control in the control management component of AAS-DA-user data assets. If the process is in the white list, AAS-DA-user will allow the process to operate on the data asset according to the Function attribute in the control management component-contract setting of the data asset; if the process is not in the white list, AAS-DA-user will not allow the process to call the data asset.

[0138] Step 603: AAS-DA-user monitors in real time whether the changes in data assets have reached the boundary conditions or whether any operations that violate the constraints have occurred, and writes the operation log into the log evidence component.

[0139] In the embodiment of the present application, during the use of data assets, data assets are monitored by AAS-DA-user, and AAS-DA-user monitors in real time whether the change of data assets has reached the maximum value of the boundary conditions or whether an operation that violates the constraint conditions has occurred through the monitor of the control management component of the data assets-usage control. If one of the above situations occurs, AAS-DA-user sends an abnormal information to the data user, and the data user forcibly terminates the process through the process monitoring-executor, and AAS-DA-user destroys the data assets through the control management component of the data assets-usage control-executor.

[0140] In this way, the use of data assets can be better controlled, and data sovereignty will always remain in the hands of the data provider.

[0141] In the embodiments of the present application, Figure 7 As shown, when the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, AAS-DA-user terminates the use and / or destroys the data assets of the data user, including:

[0142] Step 701: Based on the constraints and boundary conditions of the smart contract, the AAS-DA-user generates an operation script for terminating or destroying data assets.

[0143] Step 702: When the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, the AAS-DA-user will record the processing operation information and feed it back to the AAS-DA-supplier in real time or afterwards, so that the AAS-DA-supplier will issue a termination instruction to the AAS-DA-user, and the AAS-DA-user will call the operation script to terminate the use of the data assets. Alternatively, the AAS-DA-user can directly call the operation script to terminate the use of the data assets.

[0144] Step 703: After the use of the data asset is terminated or when the AAS-DA-user receives a destruction instruction from the AAS-DA-supplier, the data asset is destroyed.

[0145] In the embodiments of the present application, the present application generates an operation script for terminating and destroying data assets through AAS-DA-user according to the constraints and boundary conditions of the smart contract; during the use of data assets, all processing operation information of the data assets is recorded by AAS-DA-user; and feedback is provided to AAS-DA-supplier in real time or afterwards. There are two possible situations: (1) After learning about the processing of data assets, AAS-DA-supplier can actively issue a termination instruction to AAS-DA-user, and AAS-DA-user calls the operation script to terminate the use of data assets; (2) When the constraints and boundary conditions of the smart contract are met, AAS-DA-user calls the operation script to terminate the use of data assets.

[0146] After the data is used or the AAS-DA-user receives a destruction instruction from the AAS-DA-supplier, the data assets will be destroyed. Even after the data assets are destroyed, the information of their entire life cycle and the data assets associated with them can still be obtained through AAS-DA, which is convenient for post-audit liquidation and arbitration, as well as the traceability of other data assets.

[0147] In this way, data assets can be better made available but invisible, controllable and measurable, with access rights controlled and self-destructing.

[0148] In the embodiments of the application, combined with Figure 8 As shown, the data asset management method of the present application also includes:

[0149] Step 801: When the data asset is destroyed, AS-DA-user terminates the smart contract and sends the data asset destruction and smart contract termination information to the data provider and the intermediate service provider.

[0150] Step 802: After receiving the information that the data assets are destroyed and the smart contract is terminated, the data provider terminates the smart contract through AAS-DA-supplier and sends the liquidation application information to the intermediary service provider and the data user through the data provider.

[0151] Step 803: After receiving the liquidation application information, the intermediate service provider terminates the smart contract through AAS-DA-public, and reads the log evidence components of AAS-DA-supplier and AAS-DA-user through AAS-DA-public, compares them with the content of the smart contract, and implements liquidation and auditing based on the comparison results.

[0152] In the embodiments of the present application, the present application synchronizes the use process of data assets and stores evidence in multiple parties through the collaboration of AAS-DA-public, AAS-DA-user and AAS-DA-supplier, and based on the multi-party evidence storage of AAS-DA-public, AAS-DA-user and AAS-DA-supplier, performs liquidation and auditing of the use of data assets, so that the quality attributes and value attributes of data assets in AAS-DA-public can be dynamically adjusted according to the data user's evaluation of data quality and value.

[0153] Specifically, from the time when the smart contract is reached to the time when the data assets are destroyed, all operations of the data provider, data user and intermediary service provider on the data assets will be synchronously retained in the data provider's client, data user's client and intermediary service platform in the form of logs. When necessary, all evidence can be managed and traced through the blockchain.

[0154] When data assets are destroyed, the data user's client-smart contract management and AAS-DA-user's data asset control management component-contract settings will terminate the smart contract. Then, the data user's client will send the information about the destruction of data assets and the termination of the contract to the intermediate service platform and the data provider's client. After the intermediate service platform receives the information, AAS-DA-public will terminate the contract through the contract setting function of the data asset control management component and start the liquidation process.

[0155] In the embodiments of the present application, Fig. 9 As shown, the data asset active management system AAS-DA of this application is deployed on the client and the intermediate service platform. The main functions of the client include AAS-DA management, identity registration and management, smart contract management, process usage control, usage environment scanning, process management, log storage, liquidation docking, and communication functions. Specifically, the client can be deployed locally or on a private cloud. The client can be placed in a trusted and secure environment at the hardware layer, system layer, and / or software layer, where:

[0156] (I) AAS-DA management: including creating, updating, and deleting AAS-DA and its components and attributes, and configuring AAS-DA interfaces.

[0157] (ii) Identity registration and management: including the registration of client users, organizations, AAS-DA, data assets, and identity certificate management.

[0158] 3. Smart Contract Management

[0159] 1. Create a new smart contract, including user permissions, usage environment, operations on data assets, IT infrastructure requirements, transmission security requirements, etc.

[0160] 2. When the client is offline, the smart contract can still be executed through the client;

[0161] 3. Boundary conditions: specify the maximum time and maximum number of operations on data assets;

[0162] 4. Constraints: specify the types of operations that cannot be performed on data assets;

[0163] 5. Contract termination: When the data assets are destroyed, the contract is terminated.

[0164] (IV) Process usage control:

[0165] Monitor: Monitors in real time whether the process's operations on data assets have reached the maximum value of the boundary conditions, or whether any operations that violate the constraints have occurred.

[0166] Executor: Aborting process.

[0167] (V) Usage environment scanning: Perform usage environment scanning according to the requirements of the smart contract for the hardware layer, system layer and software layer in the usage environment; generate a usage environment scanning result report and a process whitelist, where the usage environment scanning result is sent by the client of the data user to the intermediate service platform and the client of the data provider at the same time, and the process whitelist is sent to the process management component for management.

[0168] (VI) Process management: Dynamic management of access control or usage control process whitelists, including maintenance of processes in the whitelist (addition, update, and removal), process permission review, etc. Among them, before the data assets reach the data user, the process whitelist output by the usage environment scanning function will be used as the initial whitelist. If a process in the whitelist is detected to violate the provisions of the smart contract during the use of the data asset, it will be removed from the whitelist. Processes that are not included in the initial whitelist will be included in the whitelist after the client's process permission review.

[0169] (VII) Log storage: For the client of the data provider, the logs of the entire life cycle of the data assets are stored; for the client of the data user and the intermediate service platform, all operation logs of the data assets are stored after the smart contract takes effect and before the contract is terminated.

[0170] (VIII) Clearing and docking: When the contract is terminated, the number of times and time of use of data assets, handling of abnormal situations, etc. are cleared by reading the logs of the data user's client, the data provider's client and the intermediate service platform.

[0171] (IX) Communication function: including communication between clients, communication between clients and AAS-DA, and communication between clients and intermediate service platforms.

[0172] In the embodiments of the present application, the functions of the intermediate service platform mainly include: identity authentication, resource directory management, supply and demand docking, smart contract management, log storage, liquidation audit, service evaluation and other functions. Specifically, the intermediate service platform can be deployed on a public cloud or a private cloud. The intermediate service platform must be placed in an environment where the hardware layer, system layer and software layer are all trusted and secure. The functions of the intermediate service platform can be implemented and operated by one or more organizations or units. Each organization or unit needs to pass identity authentication before starting related work.

[0173] Combination Fig.10 As shown, the present application also provides a method for controlling the use of data assets, which is applied to a client as a data provider, a client as a data user, and an intermediate service platform as an intermediate service provider, and the method includes:

[0174] Step 1001: The data provider and the data user perform user registration and identity authentication through their respective clients. The authenticated data provider registers and authenticates the data asset active management system AAS-DA to the intermediate service platform through the data provider's client.

[0175] Step 1002: The data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the data provider's client, so that the data user and the data provider can reach a smart contract.

[0176] Step 1003: The data user's client scans the usage environment and generates a whitelist of processes that are allowed to access or use control data assets. After confirming the processes in the whitelist, the data provider's client sends AAS-DA-user and the pre-processed data assets to the data user's client.

[0177] Step 1004: During the use of data assets, the data user's client confirms whether one or more processes that are about to call the data assets have permission based on the processes in the whitelist, and terminates and / or destroys the data assets through AAS-DA-user and AAS-DA-public when the change of the data assets reaches the boundary conditions of the smart contract or violates the constraints.

[0178] By adopting the data asset usage control method provided in the embodiment of the present disclosure, the loading and usage control of data assets is realized between the client as the data provider, the client as the data user and the intermediate service platform as the intermediate service provider through AAS-DA, so that the data sovereignty is kept in the hands of the data provider, and the data assets are available but invisible, controllable and measurable, with access rights controlled and destroyed after use. The problems of poor quality of data assets, difficulty in data intercommunication, high acquisition cost, difficulty in ensuring security, complex ownership confirmation and valuation transactions are solved, and a technical system for data sharing, circulation, transaction and security protection is formed.

[0179] In the embodiments of the present application, Fig.11 As shown, the data provider and the data user perform user registration and identity authentication through their respective clients. The authenticated data provider registers and authenticates the data asset active management system AAS-DA to the intermediate service platform through the data provider's client, including:

[0180] Step 1101: The data provider and the data user register as users through their respective clients, where user types include enterprises, organizations, and individuals.

[0181] In the embodiment of the present application, all stakeholders involved in the trusted industrial data space activities, including but not limited to data providers, data users, third parties providing log storage, liquidation and audit services, etc., need to register through their clients. User types include enterprises, organizations, individuals, etc.

[0182] Step 1102: The intermediate service platform reviews the user registration information sent by the client, authorizes a unique identity to the user who passes the review, and manages the identity according to the user type.

[0183] In an embodiment of the present application, after receiving the user registration information sent by the client, the intermediate service platform will conduct an audit. Users who pass the audit will be authorized with a globally unique identity. The intermediate service platform manages the identity according to different user types.

[0184] Step 1103: The data provider who has undergone identity authentication initiates an identity tag authorization application to the intermediate service platform through the data provider's client.

[0185] Step 1104: After the identity tag authorization application is approved, the intermediate service platform sends a unique data asset code and AAS-DA code to the client of the data provider.

[0186] Step 1105: The client of the data provider automatically writes the data asset code and the AAS-DA code into the AAS-DA identity tag to complete the registration and authentication of the data asset active management system AAS-DA.

[0187] In the embodiment of the present application, the data provider who has passed the identity authentication initiates an identity tag authorization application to the intermediate service platform through the data provider's client. After the authorization application is approved, the intermediate service platform sends a unique "global data asset code" and "global AAS-DA code" to the data provider's client. The data provider's client automatically writes the above two codes into the AAS-DA identity tag to complete the AAS-DA registration and authentication.

[0188] In the embodiments of the present application, Fig.12 As shown, the data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the client of the data provider, so that the data user and the data provider can reach a smart contract, including:

[0189] Step 1201: The data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the data provider's client. The AAS-DA-public approved by the intermediate service platform is included in the resource directory.

[0190] Step 1202: The data user's client accesses the resource directory of the intermediate service platform to query the data assets and other resources that meet the requirements. The data user's client subscribes to the resource directory or fills in the requirements for data assets and other resources. The intermediate service platform pushes the data assets and other resources according to the supply of the data assets and other resources.

[0191] Step 1203: The data user initiates an invitation to one or more data providers that meet its needs. The data provider that accepts the invitation will negotiate with the data user on the cooperation intention of data assets, and write the negotiated content into the smart contract management function of the intermediate service platform, as well as the smart contract management function of the data user's client and the data provider's client.

[0192] In this way, data providers and data users use the intermediary service platform as a medium to achieve efficient supply and demand matching and smart contract setting, thereby increasing the transaction value of data assets.

[0193] In the embodiments of the present application, Fig.13As shown, the client of the data user performs a usage environment scan and generates a whitelist of processes that are allowed to access or use the control data assets. After confirming the processes in the whitelist, the client of the data provider sends the AAS-DA-user and the pre-processed data assets to the client of the data user, including:

[0194] Step 1301: Based on the requirements of the data user's client for the usage environment, the data user's client will call the usage environment scanning component to perform a security scan on the hardware layer, system layer, and software layer of the usage environment, and perform security marking on the processes that meet the requirements of the smart contract.

[0195] Step 1302: Add the processes that have passed the security annotation to the whitelist of access control or usage control in the process management component, and the client of the data user sends it to the intermediate service platform and the client of the data provider at the same time.

[0196] Step 1303: After the data provider's client confirms the whitelist, it pre-processes the data assets according to AAS-DA-supplier and saves them as AAS-DA-user, and sends the AAS-DA-user and the pre-processed data assets to the data user's client.

[0197] In an embodiment of the present application, according to the provisions of the AAS-DA-supplier data asset control management component-contract settings, the AAS-DA-supplier will pre-process the data assets through the usage mode of the data asset control management component, including but not limited to desensitization, encryption, generation of calculation factors, etc. If "regular use" in the usage mode is selected, the data assets will be sent to the data user in plain text. If the data usage process involves multi-party collaboration, such as multi-party privacy computing, federated learning, etc., the collaborative mode of the data asset control management component will also be set. Two or more AAS-DA-suppliers that turn on the collaborative mode will achieve synchronous management of data assets during the use of data assets.

[0198] Optionally, the data provider's client can also send AAS-DA-supplier and pre-processed data assets (plain text or ciphertext) to the data user's client. The data user's client merges the received AAS-DA-supplier with the AAS-DA-user to generate a new AAS-DA-user. According to the requirements for storage environment in the AAS-DA-user data asset full life cycle management component - contract management, the data assets are stored in an environment that meets the trust requirements.

[0199] In this way, the security and reliability of the data asset usage environment can be better guaranteed.

[0200] In the embodiments of the present application, Fig.14 As shown, during the use of data assets, the client of the data user confirms whether one or more processes that are about to call the data assets have permission based on the processes in the whitelist, including:

[0201] Step 1401: One or more processes that call the data asset initiate a permission request to the client of the data user.

[0202] Step 1402: Confirm the permissions of one or more processes that are about to call the data asset by reading the whitelist of the client of the data user.

[0203] Step 1403: If the process is in the whitelist, the data user's client sends a confirmation instruction to the AAS-DA-user, allowing the process to operate on the data asset according to the Function attribute in the AAS-DA-user.

[0204] Step 1404: If the process is not in the whitelist, the data consumer's client will not allow the process to call the data asset.

[0205] In an embodiment of the present application, one or more processes that will call data assets will initiate a permission application to the client-process management of the data user, and the permission of one or more processes that will call data assets will be confirmed by reading the whitelist in the client-process management of the data user. If the process is in the whitelist, the client of the data user will send a confirmation instruction to AAS-DA-user, allowing the process to operate on the data asset according to the Function attribute in the AAS-DA-user data asset control management component-contract setting. If the process is not in the whitelist, the client of the data user will not allow the process to call the data asset.

[0206] In this way, the use of data assets can be better monitored based on the process permissions of data assets, thereby ensuring the data sovereignty and data security of data providers.

[0207] In the embodiments of the present application, Fig.15 As shown, when the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, the use of data assets is terminated and / or destroyed through AAS-DA-user and AAS-DA-public, including:

[0208] Step 1501: Based on the boundary conditions and constraints of the smart contract, the data user's client monitors in real time whether the operation of the process on the data asset has reached the maximum value of the boundary conditions, or whether an operation that violates the constraints has occurred.

[0209] Step 1502: When the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, the client of the data user forcibly terminates the process.

[0210] Step 1503: The data user's client sends an instruction to the AAS-DA-User, and the AAS-DA-user destroys the data assets.

[0211] In an embodiment of the present application, during the use of data assets, the process is monitored by the client of the data user, and the data asset is monitored by the AAS-DA-user. According to the boundary conditions and constraints in the smart contract management, the client of the data user monitors the process of the data asset in real time through the process management-monitor to see whether the operation has reached the maximum value of the boundary conditions, or whether there is an operation that violates the constraint conditions. If one of the above situations occurs, the client of the data user forcibly terminates the process through the process monitoring-executor, and sends instructions to the AAS-DA-User, and the AAS-DA-user destroys the data asset through the data asset control management component-use control-executor. At the same time, the AAS-DA-user monitors the changes of the data asset in real time through the data asset control management component-use control-monitor to see whether the change has reached the maximum value of the boundary conditions, or whether there is an operation that violates the constraint conditions. If one of the above situations occurs, the AAS-DA-user sends an exception message to the client of the data user, and the client of the data user forcibly terminates the process through the process monitoring-executor. The AAS-DA-user destroys the data asset through the data asset control management component-use control-executor.

[0212] In this way, data sovereignty can be better firmly grasped in the hands of data providers, ensuring the stability of the value of data assets.

[0213] In the embodiments of the present application, Fig.16 As shown, the use control method provided in the embodiment of the present application also includes:

[0214] Step 1601: From the time the smart contract is concluded until the data assets are destroyed, all operations on the data assets by the data provider, the data user and the intermediate service platform will be synchronized and retained in the data provider's client, the data user's client and the intermediate service platform in the form of logs.

[0215] Step 1602: When the data asset is destroyed, the data user's client and AAS-DA-user will terminate the smart contract, and send the data asset destruction and smart contract termination information to the intermediate service platform and the data provider's client through the data user's client.

[0216] Step 1603: After the intermediate service platform receives the information that the data assets are destroyed and the smart contract is terminated, AAS-DA-public will terminate the contract and start the liquidation process through the contract setting function of the data asset control management component.

[0217] In an embodiment of the present application, when data assets are destroyed, the data user's client-smart contract management, and the AAS-DA-user data asset control management component-contract settings will terminate the smart contract. Then, the data asset destruction and contract termination information is sent to the intermediate service platform and the data provider's client through the data user's client. After receiving the information, the data provider's client-smart contract management, and AAS-DA-supplier will terminate the smart contract through the data asset control management component-contract settings. After the intermediate service platform receives the information, the contract of the AAS-DA-public data asset control management component-contract settings is terminated. AAS-DA-public reads the log evidence components of AAS-DA-supplier and AAS-DA-user, and compares them with the content of the data asset control management component-contract settings.

[0218] If the data user uses the data assets normally in accordance with the provisions of the smart contract and stops using the data assets when the boundary conditions are triggered, AAS-DA-public will generate a settlement report based on the unit price of the data assets, the number of times / time of use, etc. and send it to the data user and the data provider. After the settlement, the data user can evaluate the data asset attributes such as data quality, and AAS-DA-public will update the data asset life cycle management component-data quality management and other attribute information based on the evaluation. The data provider can evaluate the credit of the data user.

[0219] If the data user fails to use the data asset in accordance with the provisions of the smart contract, AAS-DA-public will generate a settlement report based on the unit price of the data asset, the number of times / times used, and illegal operations, and send it to the data user and data provider. After the settlement, the data user cannot evaluate the attributes of the data asset. The intermediate service platform will lower the credit status of the data user. The credit status of the data user will affect the rights management and other attributes of the data asset control management component of AAS-DA-user.

[0220] In addition, the intermediate service platform will retain the AAS-DA-public until the retention period of the AAS-DA-public expires, or the data provider submits an application for destruction of the AAS-DA-public.

[0221] Optionally, if the smart contract allows the data user to copy the data assets, an AAS-DA-user-copy will be generated for the copied data assets and associated with the AAS-DA-user.

[0222] In this way, when data assets are used abnormally, AAS-DA-user can be used to better manage and control data assets and ensure the value of data assets.

[0223] Optionally, the data asset usage control method of the present application also includes the storage and destruction of AAS-DA-supplier information, and the updating of AAS-DA-supplier and AAS-DA-public. For details, please refer to the previous part of this specification, and the present application will not elaborate on it here.

[0224] Combination Fig.17 As shown, an embodiment of the present disclosure provides a computing device, including a processor 170 and a memory 171. Optionally, the device may also include a communication interface 172 and a bus 173. The processor 170, the communication interface 172, and the memory 171 may communicate with each other through the bus 173. The communication interface 172 may be used for information transmission. The processor 170 may call the logic instructions in the memory 171 to implement the data asset active management system of the above embodiment, or execute the data asset management method of the above embodiment, or execute the data asset use control method of the above embodiment.

[0225] In addition, the logic instructions in the above-mentioned memory 171 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0226] The memory 171 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present disclosure. The processor 170 executes functional applications and data processing by running the program instructions / modules stored in the memory 171, that is, to implement the data asset active management system of the above embodiment, or to execute the data asset management method of the above embodiment, or to execute the data asset use control method of the above embodiment.

[0227] The memory 171 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 171 may include a high-speed random access memory and may also include a non-volatile memory.

[0228] An embodiment of the present disclosure provides a storage medium storing program instructions, which, when executed, can implement the data asset active management system of the above-mentioned embodiment, or execute the data asset management method of the above-mentioned embodiment, or execute the data asset use control method of the above-mentioned embodiment.

[0229] The above-mentioned storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0230] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes, or a transient storage medium.

[0231] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0232] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0233] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0234] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A method for controlling the use of data assets, characterized in that: Applied to a client as a data provider, a client as a data user, and an intermediate service platform as an intermediate service provider, the method includes: The data provider and the data user register and authenticate their identities through their respective clients. The authenticated data provider registers and authenticates the data asset active management system AAS-DA to the intermediate service platform through the data provider's client. The data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the data provider's client, so that the data user and the data provider can reach a smart contract; The client of the data user scans the usage environment and generates a whitelist of processes that are allowed to access or use the control data assets. After confirming the processes in the whitelist, the client of the data provider sends the AAS-DA-user and the pre-processed data assets to the client of the data user. During the use of data assets, the data user's client confirms whether one or more processes that are about to call the data assets have permission based on the processes in the whitelist, and terminates and / or destroys the data assets through AAS-DA-user and AAS-DA-public when the change of data assets reaches the boundary conditions of the smart contract or violates the constraints.

2. The use control method according to claim 1, characterized in that: The data provider and the data user perform user registration and identity authentication through their respective clients. The authenticated data provider registers and authenticates the data asset active management system AAS-DA to the intermediate service platform through the data provider's client, including: Data providers and data users register as users through their respective clients. User types include enterprises, organizations, and individuals. The intermediate service platform reviews the user registration information sent by the client, authorizes a unique identity to the user who passes the review, and manages the identity according to the user type; The authenticated data provider initiates an identity tag authorization application to the intermediate service platform through the data provider's client; After the identity tag authorization application is approved, the intermediate service platform will send a unique data asset code and AAS-DA code to the data provider’s client; The data provider's client automatically writes the data asset code and AAS-DA code into the AAS-DA identity tag to complete the registration and authentication of the data asset active management system AAS-DA.

3. The use control method according to claim 1, characterized in that: The data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the data provider's client, so that the data user and the data provider can reach a smart contract, including: The data provider saves the data asset information to be disclosed in AAS-DA-supplier as AAS-DA-public and uploads it to the intermediate service platform through the data provider's client. The AAS-DA-public approved by the intermediate service platform is included in the resource catalog; The client of the data user accesses the resource directory of the intermediate service platform to query the data assets and other resources that meet the requirements. The client of the data user subscribes to the resource directory or fills in the demand for data assets and other resources. The intermediate service platform pushes data assets and other resources according to the supply of data assets and other resources; The data user initiates an invitation to one or more data providers that meet its needs. The data provider that accepts the invitation will negotiate with the data user on the cooperation intention of data assets, and write the negotiated content into the smart contract management function of the intermediate service platform, as well as the smart contract management function of the data user's client and the data provider's client.

4. The use control method according to claim 1, characterized in that: The client of the data user scans the usage environment and generates a whitelist of processes that are allowed to access or use the control data assets. After confirming the processes in the whitelist, the client of the data provider sends the AAS-DA-user and the pre-processed data assets to the client of the data user, including: According to the requirements of the data user's client for the usage environment, the data user's client will call the usage environment scanning component to perform security scans on the hardware layer, system layer, and software layer of the usage environment, and perform security annotations on the processes that meet the requirements of the smart contract; The processes that have passed the security annotation are included in the whitelist of access control or usage control in the process management component, and the client of the data user sends it to the client of the intermediate service platform and the data provider at the same time; After the data provider's client confirms the whitelist, it pre-processes the data assets according to AAS-DA-supplier and saves them as AAS-DA-user, and then sends AAS-DA-user and the pre-processed data assets to the data user's client.

5. The use control method according to claim 1, characterized in that: In the process of using the data asset, the client of the data user confirms whether one or more processes that are about to call the data asset have the authority according to the processes in the whitelist, including: One or more processes that call data assets will initiate permission requests to the data user's client; By reading the whitelist of the data user's client, confirm the permissions of one or more processes that are about to call the data asset; If the process is in the whitelist, the data user's client sends a confirmation instruction to AAS-DA-user, allowing the process to operate on the data asset according to the Function attribute in AAS-DA-user; If the process is not in the whitelist, the data consumer client will not allow the process to call the data asset.

6. The method for controlling use according to claim 1, characterized in that: When the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, the use of data assets will be terminated and / or destroyed through AAS-DA-user and AAS-DA-public, including: According to the boundary conditions and constraints of the smart contract, the data user's client monitors in real time whether the operation of the data asset has reached the maximum value of the boundary conditions, or whether an operation that violates the constraints has occurred; When the change of data assets reaches the boundary conditions of the smart contract or violates the constraints, the client of the data user will forcibly terminate the process; The data user's client sends instructions to AAS-DA-User, and AAS-DA-user destroys the data assets.

7. The use control method according to claim 1, characterized in that: Also includes: From the time when the smart contract is reached until the data assets are destroyed, all operations on the data assets by the data provider, data user and the intermediate service platform will be synchronously retained in the data provider's client, the data user's client and the intermediate service platform in the form of logs; When data assets are destroyed, the client of the data user and AAS-DA-user will terminate the smart contract, and send the destruction of data assets and termination of smart contracts to the client of the intermediate service platform and the data provider through the client of the data user; After the intermediate service platform receives the information that the data assets have been destroyed and the smart contract has been terminated, AAS-DA-public will terminate the contract and start the liquidation process through the contract setting function of the data asset control management component.

8. A client, characterized in that: A method for controlling the use of data assets according to any one of claims 1 to 7 is provided, comprising a processor and a memory storing program instructions, wherein the processor is configured to execute the method for controlling the use of data assets according to any one of claims 1 to 7 when running the program instructions; Wherein, the client is configured as follows: Execute data asset active management system AAS-DA management, identity registration and management, smart contract management, process use control, log storage, clearing docking and communication functions; Deployed on-premises or on a private cloud, and placed in a trusted and secure environment at the hardware, system, and / or software layers.

9. An intermediate service platform, characterized in that: A method for controlling the use of data assets according to any one of claims 1 to 7 is provided, comprising a processor and a memory storing program instructions, wherein the processor is configured to execute the method for controlling the use of data assets according to any one of claims 1 to 7 when running the program instructions; Wherein, the intermediate service platform is configured as follows: Perform identity authentication, resource directory management, supply and demand docking, smart contract management, log storage, liquidation audit and service evaluation functions; Deployed on a public or private cloud and placed in a trusted and secure environment at the hardware, system, and software layers.

10. A storage medium storing program instructions, characterized in that: When the program instructions are executed, the method for controlling the use of data assets as described in any one of claims 1 to 7 is executed.

Images