Data asset security hosting method, system and device and storage medium

Abstract

The invention provides a data asset security trusteeship method, system and device and a storage medium, and is applied to data asset security trusteeship in each industry field, the method comprises the following steps: according to a user access end information supervision demand and a user access end data range, establishing a user data asset range, the user data asset range comprising a plurality of user information, the user data asset range does not need to be manually determined, the user data asset range is automatically determined, and the protection efficiency is improved. And when the user carries out trusteeship acceptance at the user access end, carrying out privacy calculation on user information in a user data asset range to obtain an encrypted message, and sending the encrypted message to the data asset security trusteeship platform, so that the data asset security trusteeship platform returns data asset information subjected to trusteeship processing. The data asset information is stored after being subjected to privacy data reduction, so that the user data asset information of the user access end is subjected to privacy calculation, a data asset security hosting platform cannot directly obtain the user data asset information which is not subjected to privacy calculation, and the protection effect of the user data asset information is greatly improved.

Description

Technical Field

[0001] The present invention relates to a data asset security trusteeship method, system, equipment and storage medium. Background Art

[0002] In the digital economy, data assets play a vital role. Data assets refer to data resources owned or controlled by an enterprise or organization that can bring economic benefits to it. These data have the characteristics of availability, accessibility, processability and value. After being sorted, analyzed and optimized, they are valuable information that can provide support for decision-making, create competitive advantages and increase economic benefits.

[0003] Unlike traditional tangible assets, data assets do not have a physical form. They exist in digital space and are stored, transmitted, and traded in electronic form. Data assets come from a wide range of sources and in various forms, including structured data (such as tables in databases), semi-structured data (such as XML documents), and unstructured data (such as text, images, audio, video, etc.). Data can be easily copied and disseminated, and the cost of copying is extremely low. However, it should be noted that it is crucial to use and manage data assets legally and in compliance with regulations. With the acceleration of digital transformation, enterprises will become more and more dependent on data assets. With the continuous improvement of data privacy and security regulations, enterprises must strengthen data governance to ensure the legal and compliant use of data and protect user privacy. In order to ensure the security of data assets, new encryption technologies, access control technologies, and data backup and recovery technologies will continue to emerge. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a data asset security custody method, system, device and storage medium, which can achieve user data asset security protection and improve protection efficiency and protection effect.

[0005] The present application provides a data asset security custody method, the method comprising:

[0006] According to the user access terminal information supervision requirements and the user access terminal data scope, a user data asset scope is established, and the user data asset scope includes a variety of user information.

[0007] When a user initiates custody, privacy calculation is performed on the user information within the scope of the user data asset to obtain an encrypted message, which is sent to the data asset security custody platform so that the data asset security custody platform can return the data asset information after custody processing.

[0008] The data asset information is restored through privacy computing and then stored.

[0009] Optionally, sending the encrypted message to a data asset security custody platform so that the data asset security custody platform returns data asset information after custody processing, including:

[0010] The encrypted message is sent to the data asset security hosting platform so that the data asset security hosting platform and the user access terminal can conduct federated learning and escrow processing so that the data asset security hosting platform can return the data asset information after escrow processing.

[0011] Optionally, the method further comprises:

[0012] Search for update information of the user access terminal information supervision requirement and adjustment information of the user access terminal data range, and adjust the user data asset range according to the update information and the adjustment information.

[0013] Optionally, the various types of user information include basic information, enterprise information, business information, financial information, sales information, personnel information, management information, production information and procurement information.

[0014] The present application provides a data asset security trusteeship system, the system comprising: a data asset management module, a secret computing module and an operation management and scheduling module;

[0015] The data asset management module is used to establish a user data asset scope according to the user access terminal information supervision requirements and the user access terminal data scope, and the user data asset scope includes multiple types of user information.

[0016] The secret computing module is used to perform privacy computing on user information within the scope of the user data asset to obtain an encrypted message when the user performs hosting acceptance at the user access terminal;

[0017] The operation management and scheduling module is used to send the encrypted message to the data asset security custody platform so that the data asset security custody platform returns the data asset information after custody processing;

[0018] The data asset management module is used to restore the data asset information to private data and then store it.

[0019] Optionally, the system further includes a computing service management module.

[0020] The computing service management module is used for the data asset security hosting platform and the user access terminal to perform federated learning and hosting processing.

[0021] Optionally, the system also includes a data asset quality improvement module.

[0022] The data asset quality improvement module is used to search for update information of the user access terminal information supervision requirements and adjustment information of the user access terminal data range, and adjust the user data asset range according to the update information and the adjustment information.

[0023] Optionally, the confidential computing module is used to manage algorithms for performing privacy computing.

[0024] The present application provides a data asset security hosting device, which includes: cloud storage and a cloud host.

[0025] The cloud storage is an online storage mode on the network, which is a new concept extended and developed from the concept of cloud computing. It refers to a system that uses cluster applications, grid technology or distributed file systems to bring together a large number of storage devices of different types in the network to work together through application software to provide data storage and business access functions to the outside world. Through cloud storage, users can access their data anytime and anywhere, which improves the availability and convenience of data. At the same time, cloud storage also provides strong support for data sharing and collaboration, and promotes the exchange and dissemination of information.

[0026] The cloud host is a virtualized resource based on cloud computing technology, which provides users with scalable, flexible and efficient computing capabilities. The cloud host can quickly adjust the allocation of computing resources such as CPU, memory, storage, etc. according to user needs. Users can increase or decrease resources at any time according to business needs to achieve elastic scaling and execute the method described in the above embodiment.

[0027] The present application provides a computer-readable storage medium, including instructions, which, when executed on a computer, enable the computer to execute the method described in the above embodiments.

[0028] The present application provides a data asset security custody method, the method comprising: establishing a user data asset scope according to the user access terminal information supervision requirements and the user access terminal data scope, the user data asset scope including a variety of user information, no need to manually determine the user data asset scope, automatic determination of the user data asset scope, and improving protection efficiency. When the user is accepted for custody at the user access terminal, privacy calculation is performed on the user information within the user data asset scope to obtain an encrypted message, and the encrypted message is sent to the data asset security custody platform so that the data asset security custody platform returns the data asset information after custody processing, and the data asset information is restored to privacy data and then stored, so that the user data asset information of the user access terminal is privacy calculated, and the data asset security custody platform cannot directly obtain the user data asset information that has not been privacy calculated, which greatly improves the protection effect of the user data asset information. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 A schematic diagram of a process for secure data asset custody provided in an embodiment of the present application is shown;

[0031] Figure 2 A schematic diagram of a data asset security custody process provided by an embodiment of the present application is shown;

[0032] Figure 3 A schematic diagram of a data asset security custody information query process provided by an embodiment of the present application is shown;

[0033] Figure 4 A schematic diagram of the architecture of a data asset security custody method provided in an embodiment of the present application is shown;

[0034] Figure 5 A structural diagram of a data asset security custody system provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] In the following description, many specific details are set forth to facilitate a full understanding of the present application, but the present application may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present application. Therefore, the present application is not limited to the specific embodiments disclosed below.

[0037] The data asset security custody method, system, device and storage medium provided by the present invention can be used in various industries, for example, in the enterprise data asset security custody application scenario in the field of intelligent transportation. The above is only an example and does not limit the application field of the data asset security custody method, system, device and storage medium provided by the present invention.

[0038] With the continuous development of the digital economy, the laws and regulations on data security and privacy protection in various countries are becoming increasingly perfect. Enterprises need to comply with relevant laws and regulations to ensure the compliance of data processing and use. At the same time, enterprises also need to establish a sound data security management system and process system to meet regulatory requirements and reduce compliance risks. The digital economy has many requirements for data asset security, including confidentiality, integrity, availability, compliance, and a balance between technology and management. Enterprises need to take comprehensive measures to ensure the security of data assets in response to evolving threats and risks. Data asset transactions involve a data asset security hosting platform and multiple user access points, and each user access point should comply with relevant local laws and regulations.

[0039] Therefore, when the user access end sends encrypted messages to the data asset security hosting platform, it is necessary to separate the user data asset information from other information in order to perform hosting and protection processing on the user data asset information.

[0040] Based on this, the present application provides a data asset security custody method, the method comprising: establishing a user data asset scope according to the user access terminal information supervision requirements and the user access terminal data scope, the user data asset scope including a variety of user information, no need to manually determine the user data asset scope, automatic determination of the user data asset scope, and improved protection efficiency. When the user is accepted for custody at the user access terminal, privacy calculation is performed on the user information within the user data asset scope to obtain an encrypted message, and the encrypted message is sent to the data asset security custody platform so that the data asset security custody platform returns the data asset information after custody processing, and the data asset information is restored to privacy data and then stored, so that the user data asset information of the user access terminal is privacy calculated, and the data asset security custody platform cannot directly obtain the user data asset information that has not been privacy calculated, which greatly improves the protection effect of the user data asset information.

[0041] In order to better understand the technical solution and technical effects of the present application, specific embodiments will be described in detail below with reference to the accompanying drawings.

[0042] See also Figure 1 , this figure is a flow chart of a data asset security custody method provided in an embodiment of the present application.

[0043] The data asset security custody method provided in this embodiment includes the following steps:

[0044] S101, establishing a user data asset scope according to the user access terminal information supervision requirements and the user access terminal data scope.

[0045] In an embodiment of the present application, the user access terminal is regulated by local policies and regulations, that is, the user access terminal has user access terminal information supervision requirements, so privacy processing is required for user data asset information to avoid the user data asset information being transmitted without privacy processing during the communication between the user access terminal and the data asset security hosting platform.

[0046] The user data asset scope can be established based on the user access terminal information supervision requirements and the user access terminal data scope. The user data asset scope includes a variety of user information, all of which need to be privacy processed before transmission.

[0047] Specifically, the various user information includes basic information, enterprise information, business information, financial information, sales information, personnel information, management information, production information and procurement information.

[0048] As an example, basic information may include name, address or zip code, etc. Enterprise information may include unified social credit code, etc. Business information may include product specifications, product features, etc. Financial information may include bank account number, bank password, income information, deposit information and identity verification information. Sales information may include contract information, customer list or channel information, etc. Personnel information may include office account number, gender, years of work and communication content, operation records and address book, etc. Management information may include telephone number, e-mail address, social software, application account. Production information may include IP address, device MAC address, unique device identification code (S / N, etc.). Procurement information may include procurement content, email content, monitoring records, etc.

[0049] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0050] Specifically, intelligent recommendations and intelligent search technologies based on artificial intelligence and knowledge graph technology can be used to conduct intelligent searches on international and industry regulatory requirements, national standards and specifications, national laws and best practices, so as to identify information supervision needs at the user access end, establish a user data asset information database at the user access end, determine the scope of user data assets, and on this basis further sort out data assets and establish a formal data classification and grading management mechanism to meet data management requirements.

[0051] S102, when the user accepts the custody at the user access terminal, privacy calculation is performed on the user information within the scope of the user data asset to obtain an encrypted message, and the encrypted message is sent to the data asset security custody platform so that the data asset security custody platform can return the data asset information after custody processing.

[0052] In an embodiment of the present application, when a user accepts a hosting request at a user access terminal, the user data asset information involved in the service is obtained, privacy calculation is performed on the user data asset information, an encrypted message is obtained, and the encrypted message is sent to the data asset security hosting platform through a gateway interface.

[0053] refer to Figure 2 As shown, when performing privacy calculation of user data asset information, the user access end data asset privacy calculation processing device can be called.

[0054] After the data asset security custody platform obtains the encrypted message, it will perform custody processing and then return the data asset information after custody processing to the user access end.

[0055] Specifically, after sending the encrypted message to the data asset security hosting platform, the data asset security hosting platform and the user access end can conduct federated learning. For example, the data asset security hosting platform can also call the platform data asset privacy computing processing device to perform privacy computing on the user information included in the data asset security hosting platform. That is, the platform data asset privacy computing processing device jointly with the user access end data asset privacy computing processing device uses the encrypted message after the privacy computing to perform hosting processing to obtain the data asset information.

[0056] S103, performing privacy computing on the data asset information and restoring the data to store it.

[0057] In an embodiment of the present application, after receiving the data asset information, the user access terminal can perform privacy computing data restoration on the data asset information to obtain the user data asset information corresponding to the user access terminal, and then store the restored data asset information.

[0058] In an embodiment of the present application, both the user access terminal information supervision requirements and the user access terminal data range may change. Therefore, the update information of the user access terminal information supervision requirements and the adjustment information of the user access terminal data range can be searched, and the user data asset range can be adjusted according to the update information and the adjustment information. Specifically, the user data asset information library can be updated to achieve targeted and accurate improvements in the management of data assets.

[0059] In the embodiment of the present application, in order to realize the secure hosting of user data asset information, local access link permissions can be added to the terminal device of the user access end, so that user information can be queried. For terminal devices that do not belong to the user access end, such as terminal devices of the data asset security hosting platform, user data asset information of the user access end cannot be queried. Figure 3 shown.

[0060] In the embodiment of the present application, the architecture of the data asset security custody method is divided into an application layer, a platform layer and a data layer. Figure 4 The platform layer includes a data asset privacy computing processing device of a data asset security hosting platform and a data asset privacy computing processing device of a user access terminal.

[0061] It can be seen that the embodiment of the present application achieves the separation of user information and other information in the custody processing process by establishing the scope of user data assets and performing privacy calculations on user information within the scope of user data assets. In this way, the data asset security custody platform and the user access terminal can perform custody processing through federated learning without leaking their respective data.

[0062] The present application provides a data asset security custody method, the method comprising: establishing a user data asset scope according to the user access terminal information supervision requirements and the user access terminal data scope, the user data asset scope including a variety of user information, without the need to manually determine the user data asset scope, to achieve automatic determination of the user data asset scope, and improve protection efficiency. When the user is accepted for custody at the user access terminal, privacy calculation is performed on the user information within the user data asset scope to obtain an encrypted message, and the encrypted message is sent to the data asset security custody platform, so that the data asset security custody platform returns the data asset information after custody processing, and performs privacy data restoration on the data asset information for storage, so that the user information at the user access terminal is privacy calculated, and the data asset security custody platform cannot directly obtain user information that has not been privacy calculated, which greatly improves the protection effect of user information.

[0063] Based on the data asset security custody method provided in the above embodiment, the embodiment of the present application also provides a data asset security custody system, and its working principle is described in detail below with reference to the accompanying drawings.

[0064] See also Figure 5 , which is a structural diagram of a data asset security custody system provided in an embodiment of the present application.

[0065] The data asset security trusteeship system 200 provided in this embodiment includes: a data asset management module 210, a secret computing module 220 and an operation management and scheduling module 230;

[0066] The data asset management module 210 is used to establish a user data asset scope according to the user access terminal information supervision requirements and the user access terminal data scope, and the user data asset scope includes a variety of user information. The data asset management module 210 is used to restore the data asset information to privacy data for storage.

[0067] That is to say, the data asset management module 210 mainly manages the information related to the user data assets.

[0068] The secret computing module 220 is used to perform privacy computing on user information within the scope of the user data asset to obtain an encrypted message when the user performs hosting acceptance at the user access terminal.

[0069] Optionally, the secret computing module 220 is used to manage the privacy computing algorithms for privacy computing. That is to say, the secret computing module 220 mainly provides various privacy computing algorithms required for privacy computing for management, including various arithmetic calculations, geometric calculations, matrix calculations and other types of algorithms required for privacy computing according to the requirements that the original data of the user data assets does not leave the domain and the data is available but not visible, and the privacy computing of the computing adapter is used to implement the privacy intersection processing of the private data before the transmission of the message domain or field and field involving the user data asset information message domain or field in the interface file transmitted and received by the external system interface, so as to ensure that the user data assets can interact with multiple parties under the premise of ensuring security.

[0070] The operation management and scheduling module 230 is used to send the encrypted message to the data asset security custody platform so that the data asset security custody platform returns the data asset information after the business processing. In other words, the operation management and scheduling module 230 mainly manages and schedules the operation status of the platform according to the custody processing needs, and initiates privacy calculations on relevant data assets to meet the user's data asset security custody needs.

[0071] Optionally, the system further comprises a computing service management module;

[0072] The computing service management module is used for the data asset security hosting platform and the user access terminal to conduct federated learning and hosting processing. In other words, the computing service management module is mainly used to manage the privacy computing services required for user data asset information protection, including privacy intersection, privacy joint modeling and other services involving privacy computing.

[0073] Optionally, the system further includes a data asset quality improvement module;

[0074] The data asset quality improvement module is used to search for update information of the user access terminal information supervision requirements and adjustment information of the user access terminal data range, and adjust the user data asset range according to the update information and the adjustment information.

[0075] In practical applications, the system also includes an algorithm management module and a data asset service module. The algorithm management module supports users to load, debug, and manage and optimize privacy computing algorithms according to the needs of privacy data management, and supports users to query information about the algorithms. The data asset service module mainly manages the processing required to serve data assets involving privacy data, including trusted gateways, data adaptation, data routing, resource rights confirmation, encryption and decryption, and other services.

[0076] In the embodiment of the present application, the data asset security custody system 200 follows the management concept of hierarchical classification, and hierarchically and locally processes user data asset information through two-level distributed deployment and distributed processing of the data asset security custody platform and the user access terminal, so that all businesses are not affected by the handling of user data security issues.

[0077] Based on the data asset security custody method provided in the above embodiment, the embodiment of the present application further provides a data asset security custody protection device, the data asset security custody device comprising:

[0078] Cloud storage and cloud hosts, the number of cloud hosts can be one or more. In some embodiments of the present application, cloud storage and cloud hosts can be connected via the Internet or other means.

[0079] Cloud storage has excellent scalability and can be dynamically expanded according to user needs. This elastic expansion capability enables cloud storage to easily cope with data storage needs of various sizes. Cloud storage usually uses redundant backup technology to store data on servers in multiple geographical locations. This distributed storage method ensures that even if one or more servers fail, the data can still be accessed normally from other servers, greatly improving the reliability and availability of the data. Cloud storage can support a variety of data types and formats, including text, images, audio, video, etc. This flexibility enables cloud storage to meet the data storage needs of different users. With the rapid development of the Internet of Things and edge computing, cloud storage will be combined with edge computing to achieve near-end storage and processing of data.

[0080] The technical specifications of cloud hosts usually cover multiple aspects to meet different application scenarios and business needs.

[0081] The method disclosed in the above embodiment of the present application can be applied to a cloud host or implemented by a cloud host. The number of CPU cores of a cloud host is usually between 2 and 64 cores or even higher, such as some high-performance or dedicated cloud hosts may provide a higher number of cores. The number of cores directly affects the parallel processing capability and computing performance of the cloud host. In the implementation process, each step of the above method can be completed by the core instructions in the cloud host, and the methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The steps of the method disclosed in the embodiment of the present application can be directly reflected as the cloud host CPU core execution. The software module can be located in a storage medium including an SSD (solid state drive) and an HDD (hard disk drive) provided by the cloud host. SSD has a faster read and write speed and a higher IOPS (input / output operations per second), which is suitable for application scenarios requiring high-performance storage. The storage medium is located in the cloud storage and the cloud host, and the steps of the above method are completed in combination with its hardware.

[0082] The embodiment of the present application also provides a computer-readable storage medium for storing program code, where the program code is used to execute any one of the methods of the aforementioned embodiments.

[0083] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, system, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0084] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, system or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0085] When introducing elements of various embodiments of the present application, the articles "a," "an," "the," and "said" are intended to mean that there are one or more elements. The words "comprising," "including," and "having" are all inclusive and mean that there may be additional elements in addition to the listed elements.

[0086] It should be noted that a person skilled in the art can understand that all or part of the processes in the above method embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above method embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0087] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0088] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system embodiment described above is merely schematic, and the units and modules described as separate components may or may not be physically separated. In addition, some or all of the units and modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0089] The above is only a preferred implementation of the present application. Although the present application has been disclosed as a preferred embodiment, it is not intended to limit the present application. Any technician familiar with the art can use the above disclosed methods and technical contents to make many possible changes and modifications to the technical solution of the present application without departing from the scope of the technical solution of the present application, or modify it into an equivalent embodiment of equivalent changes. Therefore, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application still falls within the scope of protection of the technical solution of the present application.

Claims

1. A data asset security custody method, the method comprising: According to the user access terminal information supervision requirements and the user access terminal data scope, the user data asset scope is established. The user data asset scope includes a variety of user information. There is no need to manually determine the user data asset scope, and the user data asset scope can be automatically determined to improve protection efficiency. When the user is accepted for custody at the user access terminal, the user information within the user data asset scope is privacy calculated to obtain an encrypted message, and the encrypted message is sent to the data asset security custody platform so that the data asset security custody platform returns the data asset information after custody processing, and the data asset information is restored to privacy data and stored. In this way, the user data asset information at the user access terminal is privacy calculated, and the data asset security custody platform cannot directly obtain the user data asset information that has not been privacy calculated, which greatly improves the protection effect of the user data asset information.

2. The method according to claim 1, characterized in that The encrypted message is sent to the data asset security custody platform so that the data asset security custody platform returns the data asset information after custody processing, including: sending the encrypted message to the data asset security custody platform so that the data asset security custody platform and the user access terminal perform federated learning and complete custody processing, so that the data asset security custody platform returns the data asset information after custody processing.

3. The method according to claim 2, characterized in that The method further includes: searching for update information required by the national policies and regulations and adjustment information of the user data scope, and adjusting the user data asset scope according to the update information and the adjustment information.

4. The method according to claim 1, characterized in that The various types of user information include basic information, enterprise information, business information, financial information, sales information, personnel information, management information, production information and procurement information.

5. A data asset security custody system, characterized in that: The system includes: a data asset management module, a confidential computing module and an operation management and scheduling module; the data asset management module is used to establish a user data asset scope according to national policy and regulatory requirements and the user data scope, and the user data asset scope includes a variety of user information; the confidential computing module is used to perform privacy calculations on user information within the user data asset scope when the user is in custody processing, and obtain an encrypted message; the operation management and scheduling module is used to send the encrypted message to the data asset security custody platform, so that the data asset security custody platform returns the data asset information after custody processing; the data asset management module is used to restore the privacy data of the report data and store it.

6. The system according to claim 5, characterized in that The system also includes a computing service management module; the computing service management module is used for the data asset security hosting platform and the user to perform federated learning and hosting processing.

7. The system according to claim 5, characterized in that The system also includes a data asset quality improvement module; the data asset quality improvement module is used to search for update information required by the national policies and regulations and adjustment information of the user data range, and adjust the user data asset range according to the update information and the adjustment information.

8. The system according to claim 5, characterized in that The algorithm management module and the data asset service module. The algorithm management module supports users to load, debug and manage the privacy computing algorithm according to the needs of privacy data management, and supports users to query the algorithm information. The data asset service module mainly manages the processing required to provide services for data assets involving privacy data.

9. A data asset security custody device, characterized in that The equipment includes: cloud storage and cloud host; the cloud storage is an online storage mode on the network, which is a new concept extended and developed from the concept of cloud computing. It refers to a system that uses cluster applications, grid technology or distributed file systems to bring together a large number of storage devices of different types in the network to work together through application software to provide data storage and business access functions to the outside world. Through cloud storage, users can access their data anytime and anywhere, which improves the availability and convenience of data. At the same time, cloud storage also provides strong support for data sharing and collaboration, and promotes the exchange and dissemination of information. The cloud host is a virtualized resource based on cloud computing technology, which provides users with scalable, flexible and efficient computing capabilities. The cloud host can quickly adjust the allocation of computing resources, such as CPU, memory, storage, etc., according to user needs. Users can increase or decrease resources at any time according to business needs to achieve elastic scaling and execute the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that The method comprises instructions which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 4.

Images