A trusted data exchange method, device and storage medium based on trusted space

Abstract

The present application discloses a trusted data exchange method, device and storage medium based on a trusted space. The present application method includes: a data provider uploads data to a trusted data space; a data supply platform generates a contract, and the contract includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions and control policies; the contract information is hashed and stored in a target blockchain; the "dot", "horizontal" and "interval" in the Morse code are respectively mapped to zero-width non-connectors, zero-width connectors and zero-width space characters, and the encrypted contract identifier is converted into a Morse code format; zero-width non-connectors, zero-width connectors and zero-width space characters are embedded in random positions of the uploaded data information, and the encryption key is generated based on a preset encryption algorithm; the uploaded data information is encrypted using the encryption key.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a trusted data exchange method, device and storage medium based on a trusted space. Background Art

[0002] With the rapid development of big data, cloud computing and artificial intelligence technologies, data has become an important resource to promote global economic and technological progress. Whether in business, medical care, finance or transportation, the generation and use of data have penetrated into all aspects of daily business, and data is reshaping the operating model of all industries. In modern society, enterprises and other organizations urgently need to improve the accuracy and efficiency of decision-making, optimize resource allocation, and promote technological innovation through data sharing and exchange. For example, in some areas, cross-departmental data sharing can effectively improve the efficiency and transparency of public services; in the enterprise field, data exchange in various links of the supply chain can enhance the collaborative ability of operations and reduce the costs caused by information asymmetry.

[0003] However, despite the increasing value of data, in the process of data sharing and exchange, multiple entities and complex usage scenarios are involved, and data security, credibility and compliance have become key issues that must be addressed. These challenges not only affect the efficiency of data sharing, but may also bring potential risks to the interests, privacy security and compliance operations of data providers and users. Although existing technical means have provided preliminary solutions in some aspects, they are still unable to fully address the multi-dimensional challenges in complex data exchange scenarios.

[0004] In the process of data transmission, storage and processing, data security is of vital importance. Security risks such as unauthorized access, data leakage and tampering pose great challenges to data sharing. Although existing encryption technologies can provide a certain degree of protection for data transmission, such as using symmetric encryption or asymmetric encryption technology to ensure the confidentiality of data in the transmission channel, these traditional encryption methods cannot completely solve all security issues involved in data exchange. Especially in data sharing scenarios involving multiple subjects, how to ensure that data providers, data users and intermediaries remain transparent and secure in terms of data access control, authority management, etc. throughout the entire data interaction chain is still a technical difficulty. Especially in data sharing involving cross-departmental or cross-institutional data, different subjects may have different security specifications and operating procedures, which further exacerbates the complexity of data security management.

[0005] Data credibility is another urgent problem to be solved in the data exchange process. Credible data refers to data that maintains authenticity and integrity and is verifiable during the source, transmission and storage process. For data providers, ensuring that the source of data can be verified and that the data has not been tampered with is their core demand; for data users, the credibility of data is directly related to the quality and correctness of decision-making. In complex multi-party data exchange scenarios, data is processed by different systems or entities during transmission. How to ensure that the data maintains its integrity and authenticity throughout the entire transmission and storage process is a difficult problem that has not been fully solved by existing technologies. In addition, with the continuous flow of data, data traceability mechanisms have also become crucial. Existing technologies in data credibility verification, such as digital signatures, hash checks, etc., can guarantee data integrity to a certain extent, but these technologies are not flexible enough or have certain limitations when facing complex multi-party data exchange and dynamic data usage scenarios.

[0006] In the process of data exchange and sharing, data compliance issues involve compliance with laws and policies, especially when it comes to cross-border or cross-regional data sharing. The laws and regulations of different countries or regions often have different requirements for data privacy protection and security. For example, Europe's General Data Protection Regulation (GDPR) has strict regulations on the processing and cross-border transmission of personal data, while China's Cybersecurity Law has specific requirements for local storage and cross-border transmission of data. Therefore, in actual applications, how to ensure the legal and compliant use of data in a global data sharing scenario has become a severe challenge that enterprises and some organizations must face.

[0007] Data compliance is not only about following external regulations and policies, but also about ensuring that the data usage rights, usage period and access control can be strictly enforced in data interaction. For example, when a data provider signs a data usage contract with a data user, the data usage rights, access scope and data usage period should be clearly recorded and managed. If a data user accesses or processes data beyond the scope of permission, it will not only lead to compliance issues, but may also damage the rights and interests of the data provider. In addition, compliance also includes preventing data tampering and illegal modification during data sharing and exchange. This requires that the data exchange platform not only needs to have a strong permission management and control mechanism, but also needs to monitor and record the access and use of data throughout the process.

[0008] Although existing technologies provide some preliminary solutions in the process of data sharing and exchange, such as using traditional encryption technology to ensure the security of data transmission and verifying the integrity of data through digital signatures or hash algorithms, these methods have many limitations in practical applications. First, existing encryption technologies rely on fixed encryption key management mechanisms, and in complex multi-party data sharing scenarios, different participants often have different requirements for key management, which makes key management a technical bottleneck. Secondly, existing credibility verification methods lack dynamic adaptability and are difficult to cope with the ever-changing scenarios of data during circulation. In addition, existing technologies rely more on manual management or limited authority control methods in terms of data compliance control, lack automated policy execution and dynamic authority adjustment mechanisms, and cannot fully guarantee the strict implementation of data usage contracts and policies.

[0009] In summary, security, credibility and compliance issues in data sharing have become important factors that hinder the full realization of data value. A new technical solution is urgently needed to provide a more secure, transparent and compliant management and exchange mechanism for the data sharing platform, ensuring that the security, credibility and compliance of data are fully guaranteed in complex multi-subject and multi-dimensional data sharing scenarios. Summary of the invention

[0010] In order to solve the above technical problems, the present application provides a trusted data exchange method, device and storage medium based on a trusted space.

[0011] The technical solution provided in this application is described below:

[0012] The first aspect of the present application provides a trusted data exchange method based on a trusted space, the method comprising:

[0013] The data provider uploads the data to the trusted data space;

[0014] The data supply platform generates a contract, which includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions, and a control policy;

[0015] Hash-encrypt the contract information to generate an encrypted contract identifier, and store the contract information in the target blockchain;

[0016] Map the "dot", "horizontal" and "space" in the Morse code to zero-width non-connector, zero-width connector and zero-width space respectively, and traverse all contract identifiers to convert the encrypted contract identifiers into Morse code format;

[0017] Embed zero-width non-connector, zero-width connector and zero-width space at random positions of the uploaded data information to identify the data source and data user;

[0018] Generate an encryption key based on a data provider identifier, a data user identifier and a signing timestamp, wherein the encryption key is generated based on a preset encryption algorithm;

[0019] Based on the preset encryption algorithm, the uploaded data information is encrypted using the encryption key;

[0020] Run all data interaction and processing operations in the isolated environment of a virtual machine or container.

[0021] Optionally, after running all data interaction and processing operations in the isolated environment of the virtual machine or container, the method further includes:

[0022] After obtaining access rights, the data user decrypts the encrypted data information based on the key generated by the data provider identifier, the data user identifier and the signing timestamp, and the key is generated by the preset encryption algorithm;

[0023] Extract embedded zero-width non-connector, zero-width connector and zero-width space from the decrypted data information by using regular expressions;

[0024] Translating the zero-width non-connector, zero-width connector and zero-width space character into Morse code;

[0025] Decode the decoded Morse code into an encrypted contract identifier;

[0026] The contract identifier is compared with the contract identifier stored in the target blockchain to verify the source and usage rights of the data.

[0027] Optionally, the data information is database table data, and the running of all data interaction and processing operations in the isolated environment of the virtual machine or container includes:

[0028] Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter;

[0029] Parsing the SQL statement in the request parameter to extract the table name and the operator, wherein the table name may be extracted by using a regular expression;

[0030] Query the target contract and obtain the control policy group based on the user ID, project ID and table name;

[0031] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0032] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0033] If all are compliant, the SQL query is executed to obtain the data in the database table and the results are returned in the form of a JSON array.

[0034] Optionally, the data information is interface data, and the running of all data interaction and processing operations in the isolated environment of the virtual machine or container includes:

[0035] Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0036] Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID;

[0037] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0038] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0039] If all rules are met, the Header and Body parameters of the request parameters are forwarded to the target resource interface, and the authentication information of this platform is removed before forwarding;

[0040] Receives the result returned by the target resource interface and returns it to the caller.

[0041] Optionally, the data information is file data, and the running of all data interaction and processing operations in the isolated environment of the virtual machine or container includes:

[0042] Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0043] Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID;

[0044] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0045] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0046] If all are compliant, the file data is obtained and returned to the caller via a file stream.

[0047] Optionally, the data information is database table data, and the running of all data interaction and processing operations in the isolated environment of the virtual machine or container includes:

[0048] Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter;

[0049] Parse the SQL statement in the request parameter, extract the table name and the operator, the operator includes SELECT, UPDATE, DELETE and INSERT;

[0050] Query the target contract and obtain the control policy group based on the user ID, project ID and table name;

[0051] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0052] If the acquisition is successful, then check whether each control policy in the control policy group is compliant, wherein the control policy group includes a constraint policy for storage behavior;

[0053] If all are compliant, the SQL storage operation is executed, and the number of successful entries and status code are returned after the data is successfully stored.

[0054] Optionally, the "dot", "horizontal" and "space" in the Morse code are mapped to zero-width non-connector, zero-width connector and zero-width space respectively, and all contract identifiers are traversed to convert the encrypted contract identifier into the Morse code format including:

[0055] Creating a Morse code dictionary, wherein the Morse code dictionary defines a mapping relationship of Morse code, wherein the mapping relationship includes a representation method of "dot", "horizontal" and "space", and a conversion rule from letters and numbers to Morse code;

[0056] Create a mapping function to map "dot", "horizontal" and "space" in Morse code to corresponding zero-width characters, wherein the zero-width characters include a zero-width non-connector, a zero-width connector and a zero-width space character;

[0057] Create a conversion function to traverse the encrypted contract identifier, convert it into Morse code format, and map it.

[0058] Optionally, the mapping function is a map_to_zero_width function, and the conversion function is an encrypt_and_convert_to_morse function.

[0059] Optionally, create a conversion function that iterates over the encrypted contract identifier and converts it to Morse code format including:

[0060] Use the morse_code_dict[char.upper()] function to add a space between two groups of Morse codes;

[0061] Use the strip() method to remove the spaces at the end of a string.

[0062] A second aspect of the present application provides a trusted data exchange device based on a trusted space, comprising:

[0063] A data uploading unit, used for uploading data to a trusted data space;

[0064] A contract unit, used to generate a contract, wherein the contract includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions, and a control policy;

[0065] A contract encryption unit, used to perform hash encryption on the contract information, generate an encrypted contract identifier, and store the contract information in a target blockchain;

[0066] A conversion unit, used to map the "dot", "horizontal" and "space" in the Morse code into a zero-width non-connector, a zero-width connector and a zero-width space character respectively, and traverse all contract identifiers to convert the encrypted contract identifiers into Morse code format;

[0067] An embedding unit, used to embed a zero-width non-connector, a zero-width connector, and a zero-width space character at a random position of the uploaded data information, so as to identify the data source and the data user;

[0068] A key generation unit, used to generate an encryption key based on a data provider identifier, a data user identifier and a signing timestamp, wherein the encryption key is generated based on a preset encryption algorithm;

[0069] A data encryption unit, used to encrypt the uploaded data information using the encryption key based on the preset encryption algorithm;

[0070] Data isolation unit, which is used to run all data interaction and processing operations in the isolated environment of a virtual machine or container.

[0071] A third aspect of the present application provides a trusted data exchange device based on a trusted space, the device comprising:

[0072] Processor, memory, input-output unit, and bus;

[0073] The processor is connected to the memory, the input and output unit, and the bus;

[0074] The memory stores a program, and the processor calls the program to execute the first aspect and any optional method in the first aspect.

[0075] A fourth aspect of the present application provides a computer-readable storage medium, on which a program is stored. When the program is executed on a computer, the program executes the first aspect and any optional method in the first aspect.

[0076] It can be seen from the above technical solutions that this application has the following advantages:

[0077] 1. Use zero-width character implicit watermark technology to embed contract information in the data, effectively identify the source and user of the data, while not affecting the readability of the data and protecting the privacy of the data.

[0078] 2. The data supply platform automatically generates contracts and includes a number of key terms (such as usage rights, usage period, etc.), which can effectively regulate data usage behavior and reduce human intervention and contract disputes.

[0079] 3. During the data exchange process, through the retrieval and compliance checks of control strategies, ensure that all data interactions comply with preset policies and regulations, and improve the compliance of data management.

[0080] 4. Perform all data interactions and processing operations in the isolated environment of a virtual machine or container, reducing the risk of data leakage and improving the security of data exchange.

[0081] 5. This method design allows for flexible adjustment of contract content and control strategies in the future as needed, so that it can adapt to different application scenarios and needs.

[0082] 6. Store contract information in the blockchain to ensure the transparency and immutability of all transactions, provide comprehensive audit and traceability functions, and increase the trust of data exchange.

[0083] 7. Through automated contract generation and implicit watermark embedding, human intervention is reduced, the efficiency of data exchange and processing is improved, and operating costs are reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the technical solution in the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0085] Figure 1 A flow chart of an embodiment of a trusted data exchange method based on a trusted space provided in this application;

[0086] Figure 2A schematic diagram of an embodiment of a flow chart for converting Morse code format in a trusted data exchange method based on a trusted space provided in the present application;

[0087] Figure 3 This is a flow chart of another embodiment of a trusted data exchange method based on a trusted space provided in this application;

[0088] Figure 4 A schematic diagram of the structure of an embodiment of a trusted data exchange device based on a trusted space provided in this application;

[0089] Figure 5 This is a schematic diagram of the structure of an embodiment of another trusted data exchange device based on a trusted space provided in this application. DETAILED DESCRIPTION

[0090] It should be noted that the method provided in this application can be applied to a terminal, a system, or a server. For example, the terminal can be a smart phone or a computer, a tablet computer, a smart TV, a smart watch, a portable computer terminal, or a fixed terminal such as a desktop computer. For the convenience of explanation, this application uses the terminal as an example for explanation.

[0091] See also Figure 1 The present application first provides an embodiment of a method, which comprises:

[0092] S101, the data provider uploads the data to the trusted data space;

[0093] In this step, the data provider uploads its data to a trusted data space. The trusted data space is a secure storage area that ensures that the data will not be tampered with or leaked during the upload, storage and subsequent processing. The focus of this step is to ensure that the data provider's data upload operation is subject to strict security control to prevent unauthorized access.

[0094] S102, the data supply platform generates a contract, wherein the contract includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions, and a control policy;

[0095] After the data is uploaded, the data supply platform automatically generates a contract. This contract records the key information of data interaction, including:

[0096] Signing timestamp: Mark the time when the contract is signed to ensure a clear time record.

[0097] Data Identifier: Uniquely identifies the data involved for tracking and management purposes.

[0098] Data provider identifier: used to identify the data provider.

[0099] Data consumer identifier: used to identify the data consumer.

[0100] Usage rights: Clearly define the rights of data users on data, such as reading, modifying, forwarding, and other operations.

[0101] Usage period: The time period during which data users can access and use data.

[0102] Data modification restrictions: specify whether data is allowed to be modified, or under what circumstances it can be modified.

[0103] Control strategy: Ensure compliance and security based on the data usage and processing strategy established in the contract between the two parties.

[0104] In step S102, the specific implementation of the data supply platform generating the contract involves multiple technical and logical operations. The following is a detailed description of the process and implementation of contract generation:

[0105] After the data is uploaded, the data supply platform needs to collect relevant information to generate a contract. The following is the core information that needs to be collected:

[0106] Data provider information: including the data provider’s identity identifier (such as user ID or institution ID).

[0107] Data user information: including the data user’s identity identifier (such as user ID or company ID).

[0108] Data identifier: A unique identifier is generated for each uploaded data. The data identifier can be generated by a hash algorithm (such as SHA-256) and is used to track and manage data.

[0109] Usage permissions: clearly define the types of operations that data users can perform on data, such as read, modify, delete, or forward permissions. These permissions can be set based on the negotiation between the two parties.

[0110] Usage period: Through preset logic, both parties are allowed to define the period of data use and determine the length of time the data user can access the data.

[0111] Signing timestamp: The time when the contract is generated is one of the key metadata. The signing timestamp is generated using the current system time to ensure the validity and traceability of the contract.

[0112] In one embodiment, the platform can provide a contract template or smart contract code framework, which contains fixed contract terms and formats. These terms include but are not limited to:

[0113] Identification information of both parties to the data;

[0114] Permission rules;

[0115] Time limits;

[0116] Data modification restrictions;

[0117] Control policies (such as specific conditions for data use, storage, and modification);

[0118] The variable parts in these templates will be filled in according to the characteristics of the specific data and the conditions negotiated by both parties.

[0119] Generate the corresponding data identifier based on the characteristics of the data and the input information provided by the user, and set the corresponding usage permissions for the data user. The data identifier is generated through a hash algorithm to ensure uniqueness. For example, the following is a code example for generating a unique identifier:

[0120] import hashlib

[0121] def generate_data_identifier(data_content):

[0122] return hashlib.sha256(data_content.encode()).hexdigest()

[0123] During this process, the platform will set the data user's operating permissions for the data, such as reading, modifying, and forwarding, based on the context generated by the contract.

[0124] The platform uses the system time to generate a timestamp for the contract to ensure a clear record. The timestamp will record the exact time when the contract was generated and will be included in the contract, for example:

[0125] import time

[0126] def generate_timestamp():

[0127] return time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime())

[0128] The expiration date can also be selected through the interface or automatically generated. By setting a specific validity period, the platform will restrict the access rights of data users based on the expiration date.

[0129] Based on the negotiation between the two parties or predefined policies, the contract will contain restrictions on data modification. These restrictions will constrain whether the data user can modify the original data and under what circumstances the modification is allowed. This part may involve access control lists (ACLs) or role permission management systems to implement.

[0130] Control policies can be implemented by writing specific rules to specify compliance requirements for data when it is used. For example, control policies can include the following:

[0131] Data cannot be stored in unsecured devices.

[0132] The data cannot be used for other purposes or shared with third parties.

[0133] Data users must comply with specific encryption or storage requirements when using data.

[0134] The platform can use a rules engine or a policy framework (such as an XACML-based access control mechanism) to generate and enforce these policies.

[0135] All collected information (such as data identifiers, usage rights, usage period, contract signing time, modification restrictions and control policies) are combined to generate a complete contract. The contract can be a structured text file or a smart contract code. The specific implementation is as follows:

[0136] contract = {

[0137] "signing_timestamp": generate_timestamp(),

[0138] "data_identifier": generate_data_identifier(data_content),

[0139] "provider_id": provider_id,

[0140] "user_id": user_id,

[0141] "permissions": user_permissions, # such as read, modify, forward, etc.

[0142] "expiry_date": expiry_date,# expiry date

[0143] "modification_restrictions": modification_rules,# Data modification restrictions

[0144] "control_policies": control_policies# Control policies

[0145] }

[0146] #Store the contract in the platform database or blockchain

[0147] store_contract_in_blockchain(contract)

[0148] After the contract is generated, the platform stores it in the blockchain or trusted storage system to ensure that the contract information cannot be tampered with.

[0149] 103. Hash-encrypt the contract information to generate an encrypted contract identifier, and store the contract information in the target blockchain;

[0150] In this step, the generated contract information is encrypted using a hash algorithm to generate an encrypted contract identifier. The purpose of hash encryption is to ensure that the contract information cannot be tampered with or reversed. Afterwards, the encrypted contract identifier and related contract information are stored in the target blockchain. The use of blockchain ensures the transparency, immutability, and traceability of data and contracts.

[0151] After the contract is generated, the platform stores it in the blockchain or a trusted storage system to ensure that the contract information cannot be tampered with. When using the blockchain, the contract hash value can be stored in the blockchain in the following ways:

[0152] def store_contract_in_blockchain(contract):

[0153] contract_hash = hashlib.sha256(str(contract).encode()).hexdigest()

[0154] blockchain.store(contract_hash, contract)

[0155] S104, mapping the "dot", "horizontal" and "space" in the Morse code to a zero-width non-connector, a zero-width connector and a zero-width space character respectively, and traversing all contract identifiers, converting the encrypted contract identifiers into Morse code format;

[0156] In this step, Morse code is used to hide the encrypted contract identifier. The specific implementation is to convert the symbols in Morse code:

[0157] "dot" maps to a zero-width non-joiner.

[0158] "Horizontal" maps to a zero-width joiner.

[0159] "Space" maps to the zero-width space character.

[0160] These zero-width characters are invisible and can be embedded in text data without changing the visible content of the data. Next, all contract identifiers are traversed and converted from Moss code format to zero-width character sequences to achieve implicit identification.

[0161] S105, embedding a zero-width non-connector, a zero-width connector, and a zero-width space character at a random position of the uploaded data information to identify the data source and the data user;

[0162] The converted zero-width character sequence is embedded into the uploaded data. This embedding process is performed at random locations in the data to further enhance confidentiality. These embedded characters actually "mark" the source of the data and the user of the data in the data, so that the source of the data can be verified when necessary without affecting the normal use and appearance of the data.

[0163] In step S105, the converted zero-width character sequence is embedded into the uploaded data information to ensure that it does not affect the normal display and use of the data, and is used to mark the data source and user. This process involves randomly selecting the embedding position and inserting invisible zero-width characters (zero-width non-connector, zero-width connector, zero-width space) into the original data. The specific implementation steps are as follows:

[0164] First, through step S104, the contract identifier has been converted into a zero-width character sequence in Morse code format, including a zero-width non-connector (\u200C), a zero-width connector (\u200D) and a zero-width space (\u200B).

[0165] To ensure confidentiality, the zero-width character should be embedded at a random position in the data. You can do this by randomly generating an index value and embedding the zero-width character at that index. Then insert the generated sequence of zero-width characters into a random position in the data. The data can be in the form of a string. For example, if you use Python, strings are immutable in Python, so you need to split it into two parts, insert a zero-width character at the specified position, and then reconnect it.

[0166] The following is further explained through an example:

[0167] Assume there is a piece of uploaded data data, here take "This is some example data that will be uploaded." as an example, and the encrypted contract identifier encrypted_contract. You can embed the identifier's zero-width character sequence into the data by following the steps below:

[0168] # Assume there is a piece of uploaded data

[0169] data = "This is some example data that will be uploaded."

[0170] # Assume encrypted contract identifier

[0171] encrypted_contract = "ABC123"

[0172] # Step 1: Convert the contract identifier to a zero-width character sequence in Morse code format

[0173] zero_width_sequence = contract_identifier_to_morse(encrypted_contract)

[0174] # Step 2: Embed zero-width character sequences into the data

[0175] data_with_hidden_identifier=embed_zero_width_chars(data, zero_width_sequence)

[0176] # Output embedded data

[0177] print(data_with_hidden_identifier)

[0178] In the above example, the contract identifier (such as "ABC123") is first converted to Morse code through the Morse code dictionary, and then the "dots", "horizons", and "spaces" of the Morse code are mapped to invisible zero-width characters to form an invisible character sequence. A position is randomly selected in the data, which ensures that the embedding process is unpredictable and increases confidentiality. The embedded zero-width characters are invisible and do not affect the appearance, format, or content of the data. The original data content will not change, but it has been implicitly "marked" with the contract identifier.

[0179] The embedded zero-width characters can be used to verify the source and user of the data in the future. By extracting the zero-width character sequence from the data, converting it to Morse code format, and then restoring the encrypted contract identifier based on the Morse code, the verifier can confirm whether the source and user of the data are legitimate based on this information.

[0180] In this embodiment, by randomly embedding invisible zero-width characters in the uploaded data, the encrypted contract identifier can be implicitly embedded in the data to mark the source and user of the data. This method ensures confidentiality through the combination of random insertion and invisible characters, while not affecting the surface visible content or normal use of the data.

[0181] S106, generating an encryption key based on the data provider identifier, the data user identifier and the signing timestamp, wherein the encryption key is generated based on a preset encryption algorithm;

[0182] In step S106, an encryption key is generated based on the data provider identifier, the data user identifier and the signing timestamp. The generation of the encryption key depends on a preset encryption algorithm, such as AES or RSA, to ensure that the key is unique, secure, and can be used for subsequent data encryption operations.

[0183] Different encryption algorithms can be selected for encryption key generation, such as symmetric encryption algorithms (such as AES) or asymmetric encryption algorithms (such as RSA). In symmetric encryption, the generated key is used for encryption and decryption; while in asymmetric encryption, the generated key pair contains a public key and a private key, which are used for encryption and decryption of data.

[0184] In the following example, a symmetric encryption key is generated using the AES algorithm:

[0185] A unique encryption key is generated using information such as the data provider identifier, data consumer identifier, and signing timestamp. This information can be combined into a unique string and then processed through a hash function or encryption algorithm to generate a key.

[0186] def generate_key(data_provider_id, data_user_id, contract_timestamp):

[0187] # Combined data provider, user identifier and contract timestamp combined_info=f"{data_provider_id}{data_user_id}{contract_timestamp}"

[0188] The combined identifier information is processed through a hash algorithm to generate a fixed-length key string. The SHA-256 hash algorithm can be used to generate a 256-bit key, which is suitable for AES-256 encryption.

[0189] Based on the generated hash key, you can use the key to perform AES encryption operations. AES is a symmetric encryption algorithm that supports 128, 192, and 256-bit keys. Use the generated 256-bit key for AES encryption.

[0190] When encrypting again, the data length needs to be the size of the AES block (usually 16 bytes). Therefore, in order to ensure that the data format is correct, the pad function can be used in this embodiment to fill the data to meet the AES block size requirement.

[0191] S107: Encrypt the uploaded data information using the encryption key based on the preset encryption algorithm;

[0192] The uploaded data information is encrypted using the encryption key generated in step S106 and the preset encryption algorithm. Through this encryption operation, the data information can be effectively protected during the exchange and storage process, and only the authorized party with the decryption key can read the data information.

[0193] S108. Run all data interactions and processing operations in the isolated environment of the virtual machine or container.

[0194] In step S108, all data interactions and processing operations are run in an isolated environment of a virtual machine (VM) or container to ensure data security and reliability. Virtualization technology (VM) and containerization technology (such as Docker, Kubernetes) can provide strong isolation and controllability to prevent data from external attacks or unauthorized access during processing.

[0195] First, select an isolated environment, which uses a virtual machine or container.

[0196] Virtual Machine (VM): A virtual machine runs a complete operating system instance on a physical server through virtualization technology (such as KVM, VMware, Hyper-V, etc.). Each virtual machine has its own independent operating system, memory and storage space, isolated from the physical hardware.

[0197] Container: Container technology (such as Docker) is lighter than virtual machines. Containers share resources on the kernel of the same operating system, but the applications and their dependencies in each container are isolated to avoid mutual interference.

[0198] The choice of virtual machines or containers depends on the performance requirements, security requirements, and deployment strategy of the system. Containers are more commonly used in modern cloud computing because they are faster to deploy and have less overhead.

[0199] Use a virtualization platform such as KVM, VMware, or Hyper-V to start and manage virtual machines.

[0200] Each virtual machine can be configured with independent virtual network, storage, and computing resources to ensure that data interaction and processing are performed in an isolated environment.

[0201] A VM can be created in the following ways:

[0202] Configure a new virtual machine instance on the virtualization platform and specify resources such as the operating system, CPU, memory, and hard disk.

[0203] Deploy security tools such as firewalls and intrusion detection systems (IDS) in virtual machines to enhance the security of isolated environments.

[0204] Control network access between virtual machines through virtual switches or virtual network interfaces to ensure that only specific network communications are allowed.

[0205] Deploy all data processing and interactive operations in virtual machines to ensure that these operations are performed in a virtualized isolated environment.

[0206] Use virtualization management tools (such as vSphere, OpenStack, etc.) to monitor the operating status and resource usage of virtual machines.

[0207] If you use containerization technologies such as Docker or Kubernetes to create an isolated environment, containers are lighter than virtual machines, can be started and destroyed quickly, and are suitable for modern microservice architectures and cloud computing scenarios.

[0208] First, create a Docker image to package the application and its dependencies into a Docker image and ensure that all data processing operations run in the image.

[0209] Start the Docker container and use the created image to start one or more containers. Each container is an independent and isolated environment.

[0210] Docker network and storage volume functions are used to configure communication and data persistence between containers. The network interaction between the container and the outside world can be restricted so that data can only flow within the container or a specific network.

[0211] If large-scale deployment is required, you can use container orchestration tools such as Kubernetes to automatically manage the operation, expansion, and monitoring of multiple containers.

[0212] When processing different types of files in an isolated environment (such as a virtual machine or container), the system uses different methods to obtain, edit, delete, and store these files based on the characteristics of the file type and the specific requirements of the file operation. The following describes in detail the common methods for processing different file types in an isolated environment and their

[0213] Different file types may be obtained in different ways in an isolated environment. Common file types include:

[0214] Text files (such as .txt, .log, etc.)

[0215] Configuration files (such as .json, .yaml, .ini, etc.)

[0216] Database files (such as .db, .sql, etc.)

[0217] Binary files (such as .exe, .bin, .dll, etc.)

[0218] Multimedia files (such as .jpg, .mp4, .wav, etc.)

[0219] Depending on the file type, the system will obtain it through different channels or protocols. For example:

[0220] File system access: If the file is on the local file system of the isolated environment, the system can access it directly through the path.

[0221] Network protocol access: For files stored on remote servers, the system can obtain them through HTTP, FTP, or dedicated file transfer protocols (such as SFTP).

[0222] Database file access: If the file is database data, it can be obtained through the query interface of the database management system (such as MySQL, PostgreSQL).

[0223] Object storage access: For large-scale stored files (such as multimedia files or log files), they can be accessed through cloud services (such as AWS S3 and Azure Blob Storage).

[0224] The way files are edited and processed also differs depending on their type:

[0225] Text files

[0226] Editing: Text files can be edited directly using a command line editor (e.g. vim, nano) or modified using scripts written in programming languages ​​(e.g. Python, Java).

[0227] After the editing is completed, the file system will take effect immediately and will not occupy a lot of resources. Modifications to text files can be managed through a version control system (such as Git) to prevent misoperation.

[0228] Configuration Files

[0229] Editor: Configuration files such as .json and .yaml will be read by the application to initialize system parameters. When modifying these files, you need to pay attention to the format requirements, otherwise the program may not start normally.

[0230] After modifying the configuration file, you need to restart the application or service for the change to take effect. In an isolated environment, containers or virtual machines can use the method of mounting configuration files (such as Docker Volumes) to achieve dynamic loading.

[0231] Database files

[0232] Editing: Database files cannot be modified directly through a text editor, but must be edited through SQL statements or specialized database management tools.

[0233] After editing a database record, the response method depends on the transaction processing mechanism (such as ACID). In an isolated environment, the modification of the database file will automatically trigger the logging and backup mechanism of the database system to ensure the integrity and consistency of the data.

[0234] The way files are edited and processed also differs depending on their type:

[0235] Text files

[0236] Editing: Text files can be edited directly using a command line editor (e.g. vim, nano) or modified using scripts written in programming languages ​​(e.g. Python, Java).

[0237] After the editing is completed, the file system will take effect immediately and will not occupy a lot of resources. Modifications to text files can be managed through a version control system (such as Git) to prevent misoperation.

[0238] Configuration Files

[0239] Editor: Configuration files such as .json and .yaml will be read by the application to initialize system parameters. When modifying these files, you need to pay attention to the format requirements, otherwise the program may not start normally.

[0240] After modifying the configuration file, you need to restart the application or service for the change to take effect. In an isolated environment, containers or virtual machines can use the method of mounting configuration files (such as Docker Volumes) to achieve dynamic loading.

[0241] Database files

[0242] Editing: Database files cannot be modified directly through a text editor, but must be edited through SQL statements or specialized database management tools.

[0243] After editing a database record, the response method depends on the transaction processing mechanism (such as ACID). In an isolated environment, the modification of the database file will automatically trigger the logging and backup mechanism of the database system to ensure the integrity and consistency of the data.

[0244] In an optional embodiment, the present application also provides several implementation methods for obtaining different types of files, which are described in detail below:

[0245] For database table data, the acquisition methods include:

[0246] Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter;

[0247] Parsing the SQL statement in the request parameter to extract the table name and the operator, wherein the table name may be extracted by using a regular expression;

[0248] Query the target contract and obtain the control policy group based on the user ID, project ID and table name;

[0249] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0250] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0251] If all are compliant, the SQL query is executed to obtain the data in the database table and the results are returned in the form of a JSON array.

[0252] In this embodiment, the data user extracts the project ID and user ID from the request and parses the table name and operator in the SQL statement to query the relevant contract and obtain the control policy group. After the compliance check, the SQL query is executed and the result is returned in the form of a JSON array to ensure that the data access rights are legal and comply with the preset control policy.

[0253] For interface data, the acquisition methods include:

[0254] Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0255] Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID;

[0256] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0257] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0258] If all rules are met, the Header and Body parameters of the request parameters are forwarded to the target resource interface, and the authentication information of this platform is removed before forwarding;

[0259] Receives the result returned by the target resource interface and returns it to the caller.

[0260] In this embodiment, during the acquisition of interface data, the system extracts the project ID, resource ID and user ID from the request, queries the target contract and control policy group. After passing the compliance check, the request parameters are forwarded to the target resource interface, the authentication information of this platform is removed, and the response result of the target resource interface is returned to the caller, so that the legitimacy and security of the data request can be guaranteed.

[0261] For file data, the acquisition methods include:

[0262] Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0263] Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID;

[0264] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0265] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0266] If all are compliant, the file data is obtained and returned to the caller via a file stream.

[0267] For file data, the system extracts the project ID and resource ID from the interface address, obtains the user ID based on the authentication information, and queries the contract and control policy group. After the compliance check passes, the system obtains the file data from the storage and returns the data to the caller through the file stream, ensuring efficient transmission of large files under the premise of security and compliance.

[0268] Furthermore, the following provides an implementation method for storing database table data:

[0269] Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter;

[0270] Parse the SQL statement in the request parameter, extract the table name and the operator, the operator includes SELECT, UPDATE, DELETE and INSERT;

[0271] Query the target contract and obtain the control policy group based on the user ID, project ID and table name;

[0272] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0273] If the acquisition is successful, then check whether each control policy in the control policy group is compliant, wherein the control policy group includes a constraint policy for storage behavior;

[0274] If all are compliant, the SQL storage operation is executed, and the number of successful entries and status code are returned after the data is successfully stored.

[0275] By extracting the project ID from the interface address and obtaining the user ID based on the authentication information in the request header, the table name and operator (such as SELECT, UPDATE, DELETE, and INSERT) in the SQL statement are parsed, the contracts related to the user and project are queried, and the control policy group is obtained and its compliance is checked. If all policies are compliant, the SQL storage operation is executed, and the number of affected records and the status code are returned after successful storage. This embodiment ensures the legality of the storage operation and data security.

[0276] See also Figure 2 The present application also provides an embodiment of converting a contract identifier into a Morse code format, the embodiment comprising:

[0277] S1041, creating a Morse code dictionary, wherein the Morse code dictionary defines a mapping relationship of Morse code, wherein the mapping relationship includes a representation method of "dot", "horizontal" and "space", and a conversion rule from letters and numbers to Morse code;

[0278] S1042, creating a mapping function to map "dot", "horizontal" and "space" in the Morse code to corresponding zero-width characters, wherein the zero-width characters include a zero-width non-connector, a zero-width connector and a zero-width space character;

[0279] S1043. Create a conversion function, traverse the encrypted contract identifier, convert it into Morse code format, and map it.

[0280] In this embodiment, first, a Morse code dictionary needs to be created to map the characters in the contract identifier to dots, dashes, and spaces in Morse code. A typical Morse code dictionary is as follows:

[0281] morse_code_dict = {

[0282] 'A': '.-', 'B': '-...', 'C': '-.-.', 'D': '-..', 'E': '.',

[0283] 'F': '..-.', 'G': '--.', 'H': '....', 'I': '..', 'J': '.---',

[0284] 'K': '-.-', 'L': '.-..', 'M': '--', 'N': '-.', 'O': '---',

[0285] 'P': '.--.', 'Q': '--.-', 'R': '.-.', 'S': '...', 'T': '-',

[0286] 'U': '..-', 'V': '...-', 'W': '.--', 'X': '-..-', 'Y': '-.--',

[0287] 'Z': '--..', '1': '.----', '2': '..---', '3': '...--',

[0288] '4': '....-', '5': '.....', '6': '-....', '7': '--...',

[0289] '8': '---..', '9': '----.', '0': '-----'

[0290] }

[0291] Zero-width characters are a class of invisible characters that can include the following:

[0292] Zero Width Non-Joiner (U+200C): represents the dot (.) in Morse code.

[0293] Zero Width Joiner (U+200D): represents the horizontal line (-) in Morse code

[0294] Zero Width Space (U+200B): represents a "space" in Morse code (separation between characters)

[0295] Using these zero-width characters, Morse code can be embedded in text without changing its visible content. The corresponding mapping is as follows:

[0296] . → U+200C (Zero Width Non-Joiner)

[0297] - → U+200D (Zero Width Joiner)

[0298] → U+200B (Zero Width Space)

[0299] Next, you need to convert the encrypted contract identifier into Morse code format. This can be done as follows:

[0300] Iterate over each character in the contract identifier and convert it to Morse code

[0301] Map each character in the contract identifier to a dot and dash in the Morse code dictionary.

[0302] Mapping Morse code symbols to zero-width characters

[0303] By replacing the string, the "dot", "horizontal" and "space" of Morse code are replaced with the corresponding zero-width characters.

[0304] Convert each character of the contract identifier to a zero-width character in Morse code format

[0305] By traversing the encrypted contract identifiers, converting them one by one into Morse code and mapping them to zero-width characters, a code example is provided below:

[0306] def contract_identifier_to_morse(encrypted_contract):

[0307] morse_code = ''

[0308] for char in encrypted_contract:

[0309] if char.upper() in morse_code_dict:

[0310] morse_code += morse_code_dict[char.upper()] + ' '# Add a space between each character

[0311] morse_code = morse_code.strip() # Remove the last extra space

[0312] return morse_to_zero_width(morse_code)

[0313] The encrypted contract identifier has been converted into a string of zero-width characters, which can then be embedded in the uploaded data.

[0314] In an optional embodiment, the mapping function is a map_to_zero_width function, and the conversion function is an encrypt_and_convert_to_morse function.

[0315] Furthermore, when creating a conversion function, when traversing the encrypted contract identifier and converting it into Morse code format, you can use the morse_code_dict[char.upper()] function to add a space between two groups of Morse codes; and use the strip() method to remove the space at the end of the string.

[0316] In this optional embodiment, the map_to_zero_width function is responsible for mapping the "dot", "bar" and "space" in the Morse code to zero-width non-connector, zero-width connector and zero-width space respectively. The encrypt_and_convert_to_morse function is responsible for converting the encrypted contract identifier to the Morse code format. When traversing the encrypted contract identifier, you can use morse_code_dict[char.upper()] to convert each character to Morse code through the lookup table and add spaces between each group of Morse codes as intervals. Finally, use the strip() method to remove the extra spaces at the end of the converted string to ensure the correct format.

[0317] See also Figure 3 The present application also provides an embodiment of a method, which also requires decrypting the encrypted content. The embodiment is described in detail below, and the embodiment includes:

[0318] S301, the data provider uploads the data to the trusted data space;

[0319] S302, the data supply platform generates a contract, the contract includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions and a control policy;

[0320] S303, performing hash encryption on the contract information to generate an encrypted contract identifier, and storing the contract information in the target blockchain;

[0321] S304, mapping the "dot", "horizontal" and "space" in the Morse code to a zero-width non-connector, a zero-width connector and a zero-width space character respectively, and traversing all contract identifiers, converting the encrypted contract identifiers into Morse code format;

[0322] S305, embedding a zero-width non-connector, a zero-width connector, and a zero-width space character at a random position of the uploaded data information to identify the data source and the data user;

[0323] S306: Generate an encryption key based on the data provider identifier, the data user identifier and the signing timestamp, where the encryption key is generated based on a preset encryption algorithm;

[0324] S307: Encrypt the uploaded data information using the encryption key based on the preset encryption algorithm;

[0325] S308. Run all data interaction and processing operations in the isolated environment of the virtual machine or container.

[0326] The implementation of steps 301 to 308 in this embodiment is similar to the implementation of the related steps in the aforementioned embodiment, and will not be repeated here.

[0327] S309: After obtaining access rights, the data user decrypts the encrypted data information based on the key generated by the data provider identifier, the data user identifier and the signing timestamp, where the key is generated by the preset encryption algorithm;

[0328] After the data user obtains access rights, the encrypted data information is first decrypted based on the key generated by the data provider identifier, data user identifier and signing timestamp. The generated key is created using a preset encryption algorithm (such as AES or RSA) to ensure the security and uniqueness of the decryption process. The decrypted data will contain embedded zero-width characters, which are used to identify the source and user of the data.

[0329] S310, extracting embedded zero-width non-connector, zero-width connector and zero-width space from the decrypted data information by using a regular expression;

[0330] In this step, the embedded zero-width non-connector, zero-width connector, and zero-width space character are extracted from the decrypted data information through regular expressions. These characters are invisible in the data, so regular expressions are needed to match these specific character patterns. The extracted zero-width characters will be used for subsequent Morse code conversion.

[0331] S311, converting the zero-width non-connector, zero-width connector and zero-width space character into Morse code;

[0332] In this step, the extracted zero-width non-connectors, zero-width connectors, and zero-width space characters are converted into Morse code format. Specifically, the zero-width non-connectors are converted into "dots" in Morse code, the zero-width connectors are converted into "horizons", and the zero-width space characters represent "intervals" in Morse code. This process is completed through a predefined mapping relationship to ensure the correct representation of Morse code.

[0333] S312, decoding the decoded Morse code into an encrypted contract identifier;

[0334] Convert the decoded Morse code into an encrypted contract identifier. This process involves parsing the Morse code string and mapping each Morse symbol (dot and dash) back to the corresponding letter or number to form a complete contract identifier.

[0335] S313. Compare the contract identifier with the contract identifier stored in the target blockchain to verify the source and usage authority of the data.

[0336] Finally, the extracted contract identifier is compared with the contract identifier stored in the target blockchain. Through this comparison process, the source and usage rights of the data can be verified, ensuring that the user of the data has legal access rights and preventing unauthorized data use. This verification process is an important part of data security and ensures the compliance and reliability of data exchange.

[0337] The above describes in detail the embodiments of the method in the present application. The following describes the embodiments of the device provided in the present application: Figure 4 The present application provides an embodiment of a trusted data exchange device based on a trusted space, the embodiment comprising:

[0338] A data uploading unit 401 is used to upload data to a trusted data space;

[0339] A contract unit 402 is used to generate a contract, wherein the contract includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions and a control policy;

[0340] The contract encryption unit 403 is used to perform hash encryption on the contract information, generate an encrypted contract identifier, and store the contract information in the target blockchain;

[0341] The conversion unit 404 is used to map the "dot", "bar" and "space" in the Morse code into a zero-width non-connector, a zero-width connector and a zero-width space character, respectively, and traverse all contract identifiers to convert the encrypted contract identifiers into the Morse code format;

[0342] An embedding unit 405 is used to embed a zero-width non-connector, a zero-width connector and a zero-width space character at a random position of the uploaded data information to identify the data source and the data user;

[0343] A key generation unit 406, configured to generate an encryption key based on a data provider identifier, a data user identifier and a signing timestamp, wherein the encryption key is generated based on a preset encryption algorithm;

[0344] The data encryption unit 407 is used to encrypt the uploaded data information using the encryption key based on the preset encryption algorithm;

[0345] The data isolation unit 408 is used to run all data interaction and processing operations in the isolated environment of the virtual machine or container.

[0346] Optionally, a verification unit 409 is further included, which is used to:

[0347] After obtaining access rights, the encrypted data information is decrypted based on a key generated by a data provider identifier, a data user identifier and a signing timestamp, wherein the key is generated by the preset encryption algorithm;

[0348] Extract embedded zero-width non-connector, zero-width connector and zero-width space from the decrypted data information by using regular expressions;

[0349] Translating the zero-width non-connector, zero-width connector and zero-width space character into Morse code;

[0350] Decode the decoded Morse code into an encrypted contract identifier;

[0351] The contract identifier is compared with the contract identifier stored in the target blockchain to verify the source and usage rights of the data.

[0352] Optionally, the data information is database table data, and the data isolation unit is specifically used to: extract the project ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0353] Parsing the SQL statement in the request parameter to extract the table name and the operator, wherein the table name may be extracted by using a regular expression;

[0354] Query the target contract and obtain the control policy group based on the user ID, project ID and table name;

[0355] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0356] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0357] If all are compliant, the SQL query is executed to obtain the data in the database table and the results are returned in the form of a JSON array.

[0358] Optionally, the data information is interface data, and the data isolation unit 408 is specifically used for:

[0359] Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0360] Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID;

[0361] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0362] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0363] If all rules are met, the Header and Body parameters of the request parameters are forwarded to the target resource interface, and the authentication information of this platform is removed before forwarding;

[0364] Receives the result returned by the target resource interface and returns it to the caller.

[0365] Optionally, the data information is file data, and the data isolation unit 408 is specifically used for:

[0366] Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter;

[0367] Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID;

[0368] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0369] If the acquisition is successful, then check whether each control policy in the control policy group is compliant;

[0370] If all are compliant, the file data is obtained and returned to the caller via a file stream.

[0371] Optionally, the data information is database table data, and the data isolation unit 408 is specifically used for:

[0372] Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter;

[0373] Parse the SQL statement in the request parameter, extract the table name and the operator, the operator includes SELECT, UPDATE, DELETE and INSERT;

[0374] Query the target contract and obtain the control policy group based on the user ID, project ID and table name;

[0375] If the acquisition fails, it is determined to be an abnormal request and an error message is returned;

[0376] If the acquisition is successful, then check whether each control policy in the control policy group is compliant, wherein the control policy group includes a constraint policy for storage behavior;

[0377] If all are compliant, the SQL storage operation is executed, and the number of successful entries and status code are returned after the data is successfully stored.

[0378] Optionally, the conversion unit 404 is specifically configured to:

[0379] Creating a Morse code dictionary, wherein the Morse code dictionary defines a mapping relationship of Morse code, wherein the mapping relationship includes a representation method of "dot", "horizontal" and "space", and a conversion rule from letters and numbers to Morse code;

[0380] Create a mapping function to map "dot", "horizontal" and "space" in Morse code to corresponding zero-width characters, wherein the zero-width characters include a zero-width non-connector, a zero-width connector and a zero-width space character;

[0381] Create a conversion function to traverse the encrypted contract identifier, convert it into Morse code format, and map it.

[0382] Optionally, the mapping function is a map_to_zero_width function, and the conversion function is an encrypt_and_convert_to_morse function.

[0383] Optionally, the conversion unit 404 is specifically configured to:

[0384] Use the morse_code_dict[char.upper()] function to add a space between two groups of Morse codes;

[0385] Use the strip() method to remove the spaces at the end of a string.

[0386] See also Figure 5The present application also provides a trusted data exchange device based on a trusted space, comprising:

[0387] Processor 501, memory 502, input and output unit 503, bus 504;

[0388] The processor 501 is connected to the memory 502, the input and output unit 503 and the bus 504;

[0389] The memory 502 stores a program, and the processor 501 calls the program to execute any of the above methods.

[0390] The present application also relates to a computer-readable storage medium on which a program is stored, wherein when the program is run on a computer, the computer is caused to execute any of the above methods.

[0391] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0392] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0393] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0394] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0395] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A trusted data exchange method based on a trusted space, characterized in that: The method comprises: The data provider uploads the data to the trusted data space; The data supply platform generates a contract, which includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions, and a control policy; Hash-encrypt the contract information to generate an encrypted contract identifier, and store the contract information in the target blockchain; Map the "dot", "bar" and "space" in the Morse code to zero-width non-connector, zero-width connector and zero-width space respectively, and traverse all contract identifiers to convert the encrypted contract identifiers into Morse code format; Embed zero-width non-connector, zero-width connector and zero-width space at random positions of the uploaded data information to identify the data source and data user; Generate an encryption key based on a data provider identifier, a data user identifier and a signing timestamp, wherein the encryption key is generated based on a preset encryption algorithm; Based on the preset encryption algorithm, the uploaded data information is encrypted using the encryption key; Run all data interaction and processing operations in an isolated environment of a virtual machine or container; After running all data interaction and processing operations in the isolated environment of the virtual machine or container, the method further includes: After obtaining access rights, the data user decrypts the encrypted data information based on the key generated by the data provider identifier, the data user identifier and the signing timestamp, and the key is generated by the preset encryption algorithm; Extract embedded zero-width non-connector, zero-width connector and zero-width space from the decrypted data information by using regular expressions; Translating the zero-width non-connector, zero-width connector and zero-width space character into Morse code; Decode the decoded Morse code into an encrypted contract identifier; The contract identifier is compared with the contract identifier stored in the target blockchain to verify the source and usage rights of the data.

2. The trusted data exchange method based on trusted space according to claim 1, characterized in that: The data information is database table data, and the operation of running all data interactions and processing operations in the isolated environment of a virtual machine or container includes: Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter; Parsing the SQL statement in the request parameter to extract the table name and the operator, wherein the table name may be extracted by using a regular expression; Query the target contract and obtain the control policy group based on the user ID, project ID and table name; If the acquisition fails, it is determined to be an abnormal request and an error message is returned; If the acquisition is successful, then check whether each control policy in the control policy group is compliant; If all are compliant, the SQL query is executed to obtain the data in the database table and the results are returned in the form of a JSON array.

3. The trusted data exchange method based on trusted space according to claim 1, characterized in that: The data information is interface data, and the operation of running all data interactions and processing operations in the isolated environment of a virtual machine or container includes: Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter; Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID; If the acquisition fails, it is determined to be an abnormal request and an error message is returned; If the acquisition is successful, then check whether each control policy in the control policy group is compliant; If all rules are met, the Header and Body parameters of the request parameters are forwarded to the target resource interface, and the authentication information of this platform is removed before forwarding; Receives the result returned by the target resource interface and returns it to the caller.

4. The trusted data exchange method based on trusted space according to claim 1, characterized in that: The data information is file data, and the operation of running all data interactions and processing operations in the isolated environment of a virtual machine or container includes: Extract the project ID and resource ID from the interface address, and obtain the user ID based on the authentication information in the header of the request parameter; Query the target contract and obtain the control policy group based on the user ID, project ID and resource ID; If the acquisition fails, it is determined to be an abnormal request and an error message is returned; If the acquisition is successful, then check whether each control policy in the control policy group is compliant; If all are compliant, the file data is obtained and returned to the caller via a file stream.

5. The trusted data exchange method based on trusted space according to claim 1, characterized in that: It is characterized in that The data information is database table data, and the operation of running all data interactions and processing operations in the isolated environment of a virtual machine or container includes: Extract the project ID from the interface address and obtain the user ID based on the authentication information in the header of the request parameter; Parse the SQL statement in the request parameter, extract the table name and the operator, the operator includes SELECT, UPDATE, DELETE and INSERT; Query the target contract and obtain the control policy group based on the user ID, project ID and table name; If the acquisition fails, it is determined to be an abnormal request and an error message is returned; If the acquisition is successful, then check whether each control policy in the control policy group is compliant, wherein the control policy group includes a constraint policy for storage behavior; If all are compliant, the SQL storage operation is executed, and the number of successful entries and status code are returned after the data is successfully stored.

6. The trusted data exchange method based on trusted space according to claim 1, characterized in that: Map the "dot", "horizontal" and "space" in the Morse code to zero-width non-connector, zero-width connector and zero-width space respectively, and traverse all contract identifiers. Convert the encrypted contract identifier to the Morse code format including: Creating a Morse code dictionary, wherein the Morse code dictionary defines a mapping relationship of Morse code, wherein the mapping relationship includes a representation method of "dot", "horizontal" and "space", and a conversion rule from letters and numbers to Morse code; Create a mapping function to map "dot", "bar" and "space" in Morse code to corresponding zero-width characters, wherein the zero-width characters include a zero-width non-connector, a zero-width connector and a zero-width space character; Create a conversion function to traverse the encrypted contract identifier, convert it into Morse code format, and map it.

7. The trusted data exchange method based on trusted space according to claim 6, characterized in that: The mapping function is a map_to_zero_width function, and the conversion function is an encrypt_and_convert_to_morse function.

8. The trusted data exchange method based on trusted space according to claim 6, characterized in that: It is characterized in that Create a conversion function to traverse the encrypted contract identifier and convert it into Morse code format including: Use the morse_code_dict[char.upper()] function to add a space between two groups of Morse codes; Use the strip() method to remove the spaces at the end of a string.

9. A trusted data exchange device based on a trusted space, characterized in that: include: A data uploading unit, used for uploading data to a trusted data space; A contract unit, used to generate a contract, wherein the contract includes a signing timestamp, a data identifier, a data provider identifier, a data user identifier, usage rights, a usage period, data modification restrictions, and a control policy; A contract encryption unit, used to perform hash encryption on the contract information, generate an encrypted contract identifier, and store the contract information in a target blockchain; A conversion unit, used to map the "dot", "bar" and "space" in the Morse code into a zero-width non-connector, a zero-width connector and a zero-width space respectively, and traverse all contract identifiers to convert the encrypted contract identifiers into Morse code format; An embedding unit, used to embed a zero-width non-connector, a zero-width connector, and a zero-width space character at a random position of the uploaded data information, so as to identify the data source and the data user; A key generation unit, used to generate an encryption key based on a data provider identifier, a data user identifier and a signing timestamp, wherein the encryption key is generated based on a preset encryption algorithm; A data encryption unit, used to encrypt the uploaded data information using the encryption key based on the preset encryption algorithm; Data isolation unit, which is used to run all data interaction and processing operations in the isolated environment of virtual machines or containers; Also includes a verification unit for: After obtaining access rights, the encrypted data information is decrypted based on a key generated by a data provider identifier, a data user identifier and a signing timestamp, wherein the key is generated by the preset encryption algorithm; Extract embedded zero-width non-connector, zero-width connector and zero-width space from the decrypted data information by using regular expressions; Translating the zero-width non-connector, zero-width connector and zero-width space character into Morse code; Decode the decoded Morse code into an encrypted contract identifier; The contract identifier is compared with the contract identifier stored in the target blockchain to verify the source and usage rights of the data.

10. A trusted data exchange device based on a trusted space, characterized in that: The device comprises: Processor, memory, input-output unit, and bus; The processor is connected to the memory, the input and output unit, and the bus; The memory stores a program, and the processor calls the program to execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a program stored thereon, wherein the program, when executed on a computer, performs the method according to any one of claims 1 to 8.

Images