Data transaction security protection method based on subject and object binding relationship

Abstract

The invention discloses a data transaction security protection method based on a subject and object binding relationship. The method comprises the steps of transaction environment establishment and basic configuration; registering and auditing subject and object information; establishing and strengthening a subject-object binding relationship; transaction activity initiation and preprocessing; transaction matching and security protocol negotiation; transaction execution and security guarantee measure implementation; performing auditing and feedback processing after transaction; and updating and maintaining a data asset state. The transaction security is guaranteed, the trust and fairness are enhanced, and the healthy development of the market is promoted.

Description

Technical Field

[0001] The present invention is in the field of data transaction security, focusing on ensuring the security and reliability of data transactions based on the binding relationship between subject and object, so as to solve the security risks and trust issues in data transactions, promote the healthy development of the data transaction market, and disclose a data transaction security protection method based on the binding relationship between subject and object. Background Art

[0002] In today's era of rapid digital development, data has become an important asset, and the data trading market has emerged. The advancement of information technology has made data generation, storage and transmission convenient, transaction activities have become more frequent, the market scale has expanded, and there is huge potential in the fields of economy, science and technology, and social services.

[0003] However, in the absence of an effective security protection mechanism, data transactions face many challenges, which restrict their healthy development and highlight the need for innovative security protection methods. Summary of the invention

[0004] In order to solve the defects in the prior art, the present invention discloses a data transaction security protection method based on the subject-object binding relationship, and the technical scheme thereof is as follows: comprising the following steps: Step 1: Trading environment construction and basic configuration When building a data trading platform, we select high-performance models with redundant power supplies and hot-swappable hard drives to ensure server stability and continuous data availability during transactions. Storage devices use enterprise-level storage arrays, which support powerful data encryption and rapid recovery capabilities. When building a network architecture, we use fully homomorphic encryption technology to ensure efficient and secure data transmission. We divide different security areas such as transaction areas, storage areas, and management areas according to functional and security requirements, configure firewalls and IDS security devices in each area, strictly control inter-area access according to security policies, and monitor network activities in real time to prevent intrusions.

[0005] Establish a basic database for data transactions, and use a high-strength encryption algorithm to encrypt and store the information of transaction participants to ensure the security of information of all parties. Update the data asset catalog regularly to ensure timeliness and accuracy. The transaction rule library is revised in a timely manner based on changes in laws and regulations and market dynamics to meet legal requirements and adapt to market needs.

[0006] Step 2: Registration and review of subject and object information 1. Data Provider Registration When a data provider registers, the basic information such as corporate and / or personal identity, contact information, business license and / or identity certificate, data asset type, scale, source and purpose information, etc. is homomorphically encrypted and transmitted to the platform. After receiving the encrypted information, the platform uses the characteristics of homomorphic encryption to perform audit operations on the ciphertext, such as checking the format of the business license (using specific homomorphic encryption calculations to verify whether its structure meets the requirements) and the format of the ID card number (using regular expressions under homomorphic encryption to match similar functions). At the same time, it uses big data analysis technology to deeply explore the background information of the data provider, such as the industry reputation of the enterprise and the credit record of the individual, to assist in evaluating its reliability.

[0007] 2. Data User Registration When a data user registers and submits personal and / or corporate information, the purpose, scope and duration of use, etc., when the platform reviews the qualification intention, it must not only verify the authenticity of the submitted qualification certificate, but also evaluate its data security commitment through a risk assessment model based on risk matrix and expert experience. After the review is passed, homomorphic encryption is used to combine the initial random number assigned by the platform and the information submitted by the user to generate an encrypted unique identifier. For the password-related part, homomorphic encryption is used to store the password. When verifying the password, homomorphic encryption calculations are used to check whether the password meets the strength requirements and whether it matches the stored encrypted password. At the same time, multiple factors such as SMS verification code and biometric recognition (whose related data is also processed with homomorphic encryption) are combined to ensure user identity security.

[0008] Step 3: Establish and strengthen the subject-object binding relationship 1. Binding identity generation and storage Based on the approved information, a unique and tamper-proof binding identifier is generated for the data asset. By combining fully homomorphic encryption with hash functions, the key features of the data asset (such as data type, source, owner information, etc.) are first hashed to obtain a hash value, and then the hash value is encrypted using a fully homomorphic encryption algorithm (such as the latest efficient fully homomorphic encryption algorithm) to generate the final binding identifier. The binding identifier is closely associated with the asset owner information through fully homomorphic encryption technology to ensure that this association is indestructible and effectively prevent data assets from being illegally stolen or tampered with.

[0009] 2. Metadata encryption and access control After embedding the data asset metadata into the owner information (such as owner ID, company name, etc.), it is encrypted using fully homomorphic encryption technology. During the encryption process, an advanced key hierarchical management mechanism is introduced to divide the keys into master keys and subkeys. The master key is strictly kept by the platform security management center using a hardware security module, and the subkeys are distributed to authorized users through security policies based on different metadata access rights. In this way, the clarity of data asset ownership is effectively guaranteed, metadata is prevented from being tampered with or forged, and metadata access rights are strictly controlled to ensure that only authorized personnel can view and process relevant metadata.

[0010] Step 4: Transaction initiation and pre-processing 1. Transaction initiation and signature When the owner or agent initiates a transaction, the transaction type, price, expected object characteristics, term and other parameters as well as the transaction background description are homomorphically encrypted and sent to the platform. The platform uses the homomorphic encryption algorithm to perform parameter integrity checks on the ciphertext (such as using the CRC checksum algorithm under homomorphic encryption) and legitimacy comparisons (compared with the transaction rule base through homomorphic encryption calculations). At the same time, the transaction background description is analyzed using homomorphic encryption technology to assess transaction risks. The transaction request information is always encrypted throughout the process to prevent information leakage and tampering.

[0011] 2. Data asset status verification After receiving the request, the platform uses hash comparison technology combined with fully homomorphic encryption to verify whether the current state of the data asset is consistent with the registration information, ensuring the accuracy and legitimacy of the data asset when the transaction is initiated. In addition, the platform uses big data analysis technology to conduct an in-depth analysis of the background description of the transaction request and assess the potential risks of the transaction. For example, if the data sensitivity is high and the credit rating of the transaction object is low, it will be marked as a high-risk transaction and monitored closely.

[0012] Step 5: Transaction matching and security agreement negotiation 1. Transaction matching screening When matching and screening among registered users based on parameters, the platform adopts a multi-dimensional matching algorithm, comprehensively considering user characteristics (such as enterprise size, industry type, credit rating, historical transaction records, etc.), transaction demand matching (such as the similarity between the data type expected by the user and the data type provided by the owner, the degree of fit between the purpose of use and the purpose of data use, etc.), security assurance capabilities (such as whether the user's own data security protection measures are complete, whether they have the ability to deal with security incidents such as data leakage, etc.), and other factors. By building an advanced mathematical model to calculate the matching score, the list of potential partners that best meet the requirements is screened out. When necessary, a manual review mechanism is introduced, and professionals strictly review the matching results to ensure the accuracy and reliability of the matching results.

[0013] 2. Security agreement negotiated and determined When facilitating the negotiation of security agreements between the two parties, the two parties use fully homomorphic encryption to encrypt their respective sensitive information (such as the details of the user's security protection measures, the owner's data value assessment, etc.), and discuss and determine the terms of the agreement in an encrypted state. For example, the two parties can use the computing power of homomorphic encryption to determine the encryption algorithm (such as further optimizing the parameter selection of the fully homomorphic encryption algorithm), the authentication method (such as biometric authentication encryption processing based on homomorphic encryption), the scope of authorization (clarifying data usage permissions in an encrypted state, etc.), and the transmission and storage security standards (such as determining the data transmission encryption protocol and storage medium security level in an encrypted state) on the ciphertext, to ensure that sensitive information is not leaked during the negotiation process, and the determination of the terms of the agreement is more secure and private. The security agreement adopts a standardized template and supports customization according to the specific needs of the transaction. The entire negotiation process is completely based on homomorphic encryption technology to ensure security.

[0014] Step 6: Transaction execution and implementation of security measures 1. Data encryption transmission According to the agreement, the owner will process the data assets and metadata with full homomorphic encryption and send them to the user. In the transmission process, the characteristics of full homomorphic encryption are used to achieve functions similar to segmented encryption transmission, such as dividing the data into multiple encrypted fragments, each of which is accompanied by verification information based on homomorphic encryption calculations. After receiving the data, the user will use the decryption and verification functions of the homomorphic encryption algorithm to process it, and report any problems to the platform.

[0015] 2. Transaction monitoring and recording The platform monitors and records key node information in real time, such as the start and end time of data transmission, data volume, transmission path, etc., and monitors abnormal situations in the transaction process in real time through the monitoring system (such as abnormal surges in data traffic, illegal access attempts, abnormal changes in transmission paths, etc.). Once an abnormality is found, the monitoring system will immediately issue an alarm message and notify all parties to the transaction in a timely manner so that appropriate emergency measures can be taken to ensure transaction security. At the same time, a transaction log management system is established to record all operations and events in the transaction process in detail, and the logs are encrypted and stored using fully homomorphic encryption technology to prevent the log information from being stolen or tampered with, so as to facilitate future audits and tracking.

[0016] Step 7: Post-transaction audit and feedback processing 1. Audit operations After the transaction is completed, the platform will audit according to the standard process. Professional auditors will use audit tools (such as log analysis tools based on big data analysis, data flow analysis tools, etc.) to carefully review the operation records of both parties to the transaction, the transmission and use of data assets, the implementation of security protocols, etc. During the audit process, audit data involving sensitive information is encrypted using fully homomorphic encryption technology to ensure the security and accuracy of the audit process and prevent audit data leakage. By establishing an audit model, a comprehensive assessment of risk points in the transaction process is conducted, such as whether data use exceeds the scope of authorization, whether security protocols are effectively implemented, etc., to promptly identify potential problems.

[0017] 2. Feedback processing According to the audit results, a detailed audit report is provided to both parties of the transaction, including the transaction results, abnormal situations that occurred during the transaction, and suggested improvement measures for abnormal situations. If problems are found, the platform will take corresponding measures in a timely manner (such as suspending the trading qualifications of the violating party, requiring it to make rectifications, imposing economic penalties, etc.), and will promptly feedback the results to both parties of the transaction. At the same time, the platform sets up a variety of feedback channels (such as online questionnaires, emails, customer service hotlines, etc.) to collect the opinions and suggestions of both parties of the transaction, use text analysis technology to analyze and classify the feedback information, and continuously optimize the transaction process and security measures based on the feedback information to improve the service quality and security of the platform.

[0018] Step 8: Update and maintain data asset status 1. Asset status update When the transaction is completed, the asset status is updated according to the type. If it is a sale, the owner is changed. If the use is authorized, the information of the authorized object (name, term, scope, etc.) is recorded. During the update process, a combination of database transactions and fully homomorphic encryption technology is used to ensure the integrity and immutability of the update. Specifically, the asset status update operation records are encrypted using fully homomorphic encryption technology and stored in the database. At the same time, database transactions are used to ensure the atomicity, consistency, isolation and persistence of the update operation at the database level. For example, when updating the owner information, ensure that the entire update process is either successfully executed or not executed at all to avoid data inconsistency caused by partial updates.

[0019] 2. Asset status monitoring and maintenance Regularly review and maintain the status of assets. By establishing a data asset status monitoring system, real-time monitoring of asset usage, storage status and other information is carried out to ensure that the information is accurate and timely. The monitoring system uses sensors, log analysis and other technical means to continuously collect relevant information about data assets, such as data access frequency, storage location stability, etc. Use big data analysis technology to analyze asset status data and predict asset value change trends and potential risks so that measures can be taken in advance to manage and prevent them. For example, if the access frequency of a data asset suddenly drops, it may indicate that its value has decreased or there are potential problems. The platform can conduct further investigations or adjust management strategies accordingly. Through these measures, a reliable basis is provided for subsequent transaction management to ensure the effective management and rational use of data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The figure is a flow chart of the data transaction security protection method based on the subject-object binding relationship of the present invention. DETAILED DESCRIPTION

[0021] The present invention discloses a data transaction security protection method for a subject-object binding relationship, comprising the following steps: Step 1: Trading environment construction and basic configuration Enterprise A and individual C plan to conduct data transactions, and they have chosen a professional data transaction platform. In terms of server selection, the platform has selected high-end models with powerful redundant power supplies and hot-swappable hard disk functions to ensure the stable operation of the server during the transaction, prevent data transaction interruptions due to hardware failures, and ensure the continuous availability of data. The storage device uses an enterprise-level storage array, supports high-intensity data encryption algorithms, ensures the confidentiality of data storage, and has fast data recovery capabilities, which can be quickly restored when data is damaged. When building the network architecture, cutting-edge fully homomorphic encryption technology is used to ensure efficient and secure data transmission. Different security areas such as transaction areas, storage areas, and management areas are divided according to functions and security requirements. Each area is equipped with high-performance firewalls and IDS security devices. Access between areas is controlled according to strict policies, and intrusions are monitored and prevented in real time.

[0022] The platform establishes a basic database for data transactions, and uses advanced encryption algorithms to encrypt and store the information of transaction participants to prevent information leakage. The data asset catalog is updated regularly, and the latest data asset information is obtained in a timely manner through data mining and analysis technology to ensure timeliness and accuracy, making it convenient for both parties to the transaction to find the required data. The transaction rule library is revised in a timely manner in accordance with changes in laws and regulations and market dynamics. The platform has a special regulatory monitoring team to track regulatory updates, and combines big data to analyze market trends to ensure that transaction rules are legal and meet market demand.

[0023] Step 2: Registration and review of subject and object information 1. Data Provider Registration When Enterprise A registers as a data provider, it transmits the enterprise name, unified social credit code, legal person information, contact information, data assets (such as customer consumption behavior data, including type, scale, source and purpose description), detailed data usage history based on encryption technology (such as past transaction data usage and implementation of security measures) and data security measures description to the platform after homomorphic encryption. After receiving the encrypted information, the platform uses the characteristics of homomorphic encryption to perform audit operations on the ciphertext, such as verifying whether the business license format meets the requirements through specific homomorphic encryption calculations, using regular expression matching under homomorphic encryption to check the legal person information format, and using big data to analyze enterprise A's industry reputation, historical transaction data and other background information to assist in evaluating its reliability. When individual C registers as a data provider, he submits his name, ID number, contact information, health data (type and source are personal medical records, and the purpose is scientific research), legal and compliance instructions for data collection channels (such as obtained through formal channels in hospitals), and other information for homomorphic encryption. The platform manually verifies the authenticity of the ID card (performs partial verification operations on the ciphertext through homomorphic encryption-related technologies), automatically checks the data format (using homomorphic encryption calculations), and comprehensively evaluates the reliability of his data transactions through big data analysis of the authenticity of individual C's data collection channel instructions and personal credit records.

[0024] 2. Data User Registration

[0025] Assume that there are data users, enterprise B and scientific research institution D. Enterprise B registers and submits enterprise information, purpose of use (for product R&D optimization), scope (specific product line), duration (one year), relevant industry qualification certificates based on encryption technology (such as product R&D related business licenses) and data security commitments. When the platform reviews its qualification intentions, it not only strictly verifies the authenticity of the qualification certificates, but also evaluates its data security commitments through a risk assessment model based on risk matrix and expert experience, and comprehensively considers enterprise B's industry background, past data usage behavior (if any), feasibility and effectiveness of the promised security measures and other factors to predict the security risks it may bring in data transactions. After the review is passed, homomorphic encryption is used to combine the initial random number assigned by the platform and the information submitted by enterprise B to generate an encrypted unique identifier. For the password-related part, homomorphic encryption is used to store the password. When verifying the password, homomorphic encryption calculations are used to check whether the password meets the strength requirements and whether it matches the stored encrypted password. At the same time, the SMS verification code and biometric recognition (such as fingerprint recognition, the relevant data is also homomorphically encrypted) are combined to ensure password security. Scientific research institution D registers and submits institutional qualifications, research project information, purpose of use (medical research), scope (specific topics), duration (two years), relevant scientific research qualification certificates based on encryption technology (such as medical research licenses), and data security commitments. The platform reviews the qualification intentions, verifies the authenticity of the qualification certificates, and evaluates its security commitments through risk assessment models. After the review is passed, homomorphic encryption is used to combine relevant information to generate an encrypted unique identifier, and a combination of password and SMS verification code authentication is used (password-related data is homomorphically encrypted) to ensure password security.

[0026] Step 3: Establish and strengthen the subject-object binding relationship 1. Binding identity generation and storage Based on the approved information, the platform generates a binding identifier for the data assets of Enterprise A. First, the key features of the data assets (such as the data type is customer consumption behavior data, the source is the internal database of Enterprise A, and the owner information is the relevant identifier of Enterprise A, etc.) are hashed to obtain a hash value, and then the hash value is encrypted using a fully homomorphic encryption algorithm (such as the latest and most efficient fully homomorphic encryption algorithm) to generate the final binding identifier. The binding identifier is closely associated and stored with the information of Enterprise A through fully homomorphic encryption technology to ensure that the relationship is indestructible and effectively prevent the data assets from being stolen or tampered with.

[0027] 2. Metadata encryption and access control The ID and name of enterprise A are embedded in the metadata of data assets, encrypted using fully homomorphic encryption technology, and an advanced key hierarchical management mechanism is introduced to divide the keys into master keys and subkeys. The master key is strictly kept by the platform security management center using a hardware security module, and the subkeys are distributed to authorized users through security policies according to different metadata access rights to ensure clear ownership of data assets, prevent metadata tampering or forgery, and strictly control metadata access rights. The platform generates a binding identifier for the health data of individual C. First, the key features of the data (such as the data type is health data, the source is personal medical records, and the owner is individual C) are hashed to obtain a hash value, and then encrypted using a fully homomorphic encryption algorithm (such as an advanced fully homomorphic encryption scheme) to generate a binding identifier, which is stored in association with individual C's information. The name of individual C and other information are embedded in the metadata of data assets and encrypted, and a key hierarchical management mechanism is adopted to ensure clear ownership of data assets, prevent metadata tampering or forgery, and strictly control access rights.

[0028] Step 4: Transaction initiation and pre-processing 1. Transaction initiation and signature Enterprise A initiates a data sharing transaction, and sends the transaction type as sharing, the expected transaction object as an enterprise in the same industry (such as enterprise B), the transaction period of one year, and other parameters, as well as detailed transaction background descriptions (such as the shared data is used to jointly develop the market and the importance of data to market analysis, etc.) to the platform after homomorphic encryption. The platform uses homomorphic encryption algorithms to perform parameter integrity checks on ciphertext (such as using CRC checksums under homomorphic encryption and similar functions), legality comparisons (comparisons with transaction rule bases through homomorphic encryption calculations), and other operations. At the same time, homomorphic encryption technology is used to analyze the transaction background description and assess potential risks. If the data sensitivity is high and the credit rating of the transaction object is low, it is marked as a high-risk transaction for key monitoring. Individual C initiates an authorized use transaction, and sends the clear type, expected object characteristics (scientific research institutions), period, and detailed transaction background descriptions (such as authorization to promote medical research progress) after homomorphic encryption. The platform checks the integrity and legality of the parameters, verifies the status of data assets, and uses homomorphic encryption technology to assess the potential risks of the transaction.

[0029] 2. Asset status verification After receiving the request, the platform uses hash comparison technology combined with fully homomorphic encryption to verify the consistency between the current status of the data asset and the registration information, ensuring that the data assets are accurate and legal when the transaction is initiated.

[0030] Step 5: Transaction matching and security agreement negotiation 1. Transaction matching screening When the platform matches and screens among registered users based on parameters, it adopts a multi-dimensional matching algorithm, comprehensively considering factors such as enterprise scale (Enterprise B is easier to match with Enterprise A if the scale is similar), industry type (higher matching degree of needs in the same industry), credit rating (Enterprise B has good credit), historical transaction records (no bad records), transaction demand matching degree (Enterprise B's product development needs match the data type of Enterprise A), and security assurance capabilities (Enterprise B has complete data security protection measures), etc., and builds an advanced mathematical model to calculate the matching score, screen out Enterprise B as a potential partner, and conduct manual review when necessary. For the transaction matching between individual C and scientific research institution D, the platform also adopts a multi-dimensional matching algorithm, considering factors such as the qualifications of scientific research institution D, the relevance of research projects and individual C's data, credit rating, and security assurance capabilities. For example, if scientific research institution D has deep qualifications in the field of medical research, the research project is closely related to individual C's health data, the credit rating is high, and it has complete security measures, it is easier to be screened as a potential partner.

[0031] 2. Security agreement negotiated and determined When promoting enterprise A and enterprise B to negotiate a security agreement, both parties use fully homomorphic encryption to encrypt their respective sensitive information (such as the details of enterprise B's security protection measures, enterprise A's data value assessment, etc.), and discuss and determine the terms of the agreement in an encrypted state. For example, the two parties can use the computing power of homomorphic encryption to determine the encryption algorithm (such as further optimizing the parameter selection of the fully homomorphic encryption algorithm), the authentication method (such as biometric authentication encryption processing based on homomorphic encryption), the scope of authorization (clearly specifying detailed permissions such as data usage methods, scenarios, and sharable objects), and the transmission and storage security standards (such as determining the data transmission encryption protocol and storage medium security level in an encrypted state) on the ciphertext, to ensure that sensitive information is not leaked during the negotiation process, and the determination of the terms of the agreement is more secure and private. The security agreement adopts a standardized template and supports customization according to the specific needs of the transaction, such as selecting appropriate fully homomorphic encryption algorithm parameters and security configurations based on data sensitivity. For transactions between individual C and scientific research institution D, determine the appropriate encryption algorithm (such as a combination of fully homomorphic encryption and asymmetric encryption), authentication method (such as password authentication combined with institutional digital certificates), authorization scope (clarify scientific research purposes and usage restrictions), and transmission and storage security standards (such as cutover encryption protocols and storage conditions that meet scientific research data security requirements), and use fully homomorphic encryption technology to protect the security of sensitive information exchange during the negotiation process.

[0032] Step 6: Transaction execution and implementation of security measures 1. Data encryption transmission Enterprise A performs fully homomorphic encryption on data assets and metadata according to the agreement, attaches relevant information such as binding identification, and sends it to enterprise B through a secure transmission channel. During transmission, the characteristics of fully homomorphic encryption are used to divide the data into multiple encrypted fragments, each with verification information (based on homomorphic encryption calculation). After receiving, enterprise B uses the decryption and verification functions of the homomorphic encryption algorithm to process it. If problems such as data integrity verification failure or decryption error are found, it will immediately report to the platform and stop the transaction operation. Individual C encrypts and transmits data to scientific research institution D according to the agreement. First, the health data is processed using fully homomorphic encryption, and then encrypted with the public key of scientific research institution D and sent with relevant binding identification. After receiving, scientific research institution D decrypts it with a private key, verifies the integrity and accuracy of the data according to the agreement, and reports any problems to the platform in a timely manner.

[0033] 2. Transaction monitoring and recording The platform monitors and records key node information in real time, such as the start and end time of data transmission, data volume, transmission path, etc., and monitors abnormal situations in the transaction process in real time through the monitoring system (such as abnormal surges in data traffic, illegal access attempts, abnormal changes in transmission paths, etc.). Once an abnormality is found, the monitoring system will immediately issue an alarm message and notify all parties to the transaction in a timely manner so that appropriate emergency measures can be taken to ensure transaction security. At the same time, a transaction log management system is established to record all operations and events in the transaction process in detail, and the logs are encrypted and stored using fully homomorphic encryption technology to prevent the log information from being stolen or tampered with, so as to facilitate future audits and tracking.

[0034] Step 7: Post-transaction audit and feedback processing 1. Audit operations After the transaction is completed, the platform will audit according to the standard process. Professional auditors will use audit tools (such as log analysis tools based on big data analysis, data flow analysis tools, etc.) to carefully review the operation records of both parties to the transaction, the transmission and use of data assets, the implementation of security protocols, etc. During the audit process, audit data involving sensitive information is encrypted using fully homomorphic encryption technology to ensure the security and accuracy of the audit process and prevent audit data leakage. By establishing an audit model, a comprehensive assessment of risk points in the transaction process is conducted, such as whether data use exceeds the scope of authorization, whether security protocols are effectively implemented, etc., to promptly identify potential problems.

[0035] 2. Feedback processing According to the audit results, a detailed audit report is provided to both parties of the transaction, including the transaction results, abnormal situations that occurred during the transaction, and suggested improvement measures for abnormal situations. If problems are found, the platform will take corresponding measures in a timely manner (such as suspending the trading qualifications of the violating party, requiring it to make rectifications, imposing economic penalties, etc.), and will promptly feedback the results to both parties of the transaction. At the same time, the platform sets up a variety of feedback channels (such as online questionnaires, emails, customer service hotlines, etc.) to collect the opinions and suggestions of both parties of the transaction, use text analysis technology to analyze and classify the feedback information, and continuously optimize the transaction process and security measures based on the feedback information to improve the service quality and security of the platform.

[0036] Step 8: Update and maintain data asset status 1. Asset status update When the transaction is completed, the asset status is updated according to the type. If it is a sale, the owner is changed. If the use is authorized, the information of the authorized object (name, term, scope, etc.) is recorded. During the update process, a combination of database transactions and fully homomorphic encryption technology is used to ensure the integrity and immutability of the update. Specifically, the asset status update operation records are encrypted using fully homomorphic encryption technology and stored in the database. At the same time, database transactions are used to ensure the atomicity, consistency, isolation and persistence of the update operation at the database level. For example, when updating the owner information, ensure that the entire update process is either successfully executed or not executed at all to avoid data inconsistency caused by partial updates.

[0037] 2. Asset status monitoring and maintenance Regularly review and maintain the status of assets. By establishing a data asset status monitoring system, real-time monitoring of asset usage, storage status and other information is carried out to ensure that the information is accurate and timely. The monitoring system uses sensors, log analysis and other technical means to continuously collect relevant information about data assets, such as data access frequency, storage location stability, etc. Use big data analysis technology to analyze asset status data and predict asset value change trends and potential risks so that measures can be taken in advance to manage and prevent them. For example, if the access frequency of a data asset suddenly drops, it may indicate that its value has decreased or there are potential problems. The platform can conduct further investigations or adjust management strategies accordingly. Through these measures, a reliable basis is provided for subsequent transaction management to ensure the effective management and rational use of data assets.

[0038] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A data transaction security protection method based on subject-object binding relationship, characterized by: Step 1: Trading environment construction and basic configuration When building a data trading platform, the server should be equipped with redundant power supplies and hot-swappable hard disks; the storage device should use an enterprise-level storage array that supports data encryption and rapid recovery; the network architecture should be built, encryption technology should be used to ensure efficient and secure transmission, and different security areas such as transaction areas, storage areas, and management areas should be set up according to functional safety requirements. Firewalls and IDS security devices should be configured to control access between areas according to policies, and real-time monitoring should be carried out to prevent intrusions; Build a basic database for data transactions, encrypt and store transaction participant information to ensure security; update the data asset catalog regularly; and revise the transaction rule base in a timely manner in accordance with laws, regulations and market changes; Step 2: Registration and review of subject and object information When registering, data providers must provide corporate and / or personal identity, contact information, business license and / or identity certificate, data asset type, size, source and purpose information, and digital signature; The platform manually reviews the authenticity of the business license, and the automated review uses regular expressions to check the ID card number format; Data users register and submit personal and / or corporate information, purpose, scope and duration of use. The platform will review the qualifications and intentions, and assign a unique ID and initial password after passing. The passwords must be modified regularly, and password strength detection tools are used to ensure security. Step 3: Establish and strengthen the subject-object binding relationship Based on the audit information, a binding identifier is generated for the data asset, and the asset and owner information are stored to ensure a close relationship that cannot be tampered with; the data asset metadata is embedded with the owner information and encrypted to ensure that the ownership is clear and tamper-proof. Only authorized users can decrypt and view the data, and the key management system is used to strictly control the distribution of decryption keys; Step 4: Transaction initiation and pre-processing The owner or agent initiates the transaction, specifies the type, price, desired object characteristics, and term parameters, and digitally signs again to ensure authenticity and integrity; After receiving the request, the platform uses the CRC checksum algorithm to check the integrity of the parameters, compares the legality according to the rule base, and reviews the type compliance, such as checking whether the price is reasonable and whether the term is compliant; hash comparison is used to verify the status of data assets to ensure consistency with the registration information; Step 5: Transaction matching and security agreement negotiation The platform matches and screens registered users based on parameters, and uses a multi-dimensional matching algorithm combined with manual review to determine the list of potential partners; Facilitate the negotiation of security agreements between the two parties and determine encryption algorithms, authentication methods, authorization scopes, and transmission and storage security standards; Step 6: Transaction execution and implementation of security measures According to the agreement, the owner encrypts and transmits data assets and metadata, with a binding identifier attached; after receiving, the user decrypts and verifies according to the agreement, and reports and stops if there is a problem; the platform monitors and records key nodes in real time, and the monitoring system notifies all parties in real time when an abnormality occurs; Step 7: Post-transaction audit and feedback processing After the transaction is completed, the platform will audit according to the standard process and use tools to review the operations, asset status, and agreement execution of both parties; provide reports to both parties, including transaction results, anomalies, and suggested improvement measures; handle and feedback any problems in a timely manner, and set up multiple channels to collect feedback and optimize process measures; Step 8: Update and maintain data asset status When a transaction is completed, the asset status is updated according to the type. If it is sold, the owner is changed. If it is authorized to use, the information of the authorized object is recorded. The transaction history changes are recorded and the integrity of the update is ensured by database transactions. The asset status is regularly reviewed and maintained to ensure that the information is accurate and timely, providing a basis for subsequent transaction management.

2. According to claim 1, a data transaction security protection method based on subject-object binding relationship is characterized by: The step three further includes the following contents: Binding identity generation and storage Based on the approved information, a unique and tamper-proof binding identifier is generated for the data asset. By combining fully homomorphic encryption with a hash function, the key features of the data asset are first hashed to obtain a hash value, and then the hash value is encrypted using a fully homomorphic encryption algorithm to generate the final binding identifier. The binding identifier and asset owner information are closely associated and stored through fully homomorphic encryption technology; Metadata encryption and access control After embedding the data asset metadata into the owner information, it is encrypted using fully homomorphic encryption technology. During the encryption process, an advanced hierarchical key management mechanism is introduced to divide the key into a master key and a subkey. The master key is strictly kept by the platform security management center using a hardware security module, and the subkeys are distributed to authorized users through security policies based on different metadata access rights.

3. The data transaction security protection method based on subject-object binding relationship according to claim 1 is characterized in that: The step 4 further includes the following contents: Transaction initiation and signature When the owner or agent initiates a transaction, the transaction type, price, expected object characteristics, term parameters, and transaction background description are homomorphically encrypted and sent to the platform; the platform uses the homomorphic encryption algorithm to perform parameter integrity check and legality comparison operations on the ciphertext. At the same time, the homomorphic encryption technology is used to analyze the transaction background description and assess the transaction risk. During the whole process, the transaction request information is always encrypted to prevent information leakage and tampering; Asset Status Verification After receiving the request, the platform uses hash comparison technology combined with fully homomorphic encryption to verify whether the current status of the data asset is consistent with the registration information, ensuring the accuracy and legality of the data asset when the transaction is initiated; assessing the potential risks of the transaction. For example, if the data sensitivity is high and the credit rating of the transaction counterparty is low, it will be marked as a high-risk transaction and monitored closely.

4. According to claim 1, a data transaction security protection method based on subject-object binding relationship is characterized by: The step five further includes the following contents: Transaction matching screening When matching and screening among registered users based on parameters, the platform adopts a multi-dimensional matching algorithm, comprehensively considering factors such as user characteristics, transaction demand matching, and security assurance capabilities, and calculates matching scores by building advanced mathematical models to screen out a list of potential partners that best meet the requirements; Security agreement negotiated When promoting the two parties to negotiate a security agreement, the two parties use fully homomorphic encryption to encrypt their respective sensitive information, and discuss and determine the terms of the agreement in an encrypted state, ensuring that sensitive information is not leaked during the negotiation process and that the determination of the terms of the agreement is more secure and private; the security agreement uses a standardized template and supports customization according to the specific needs of the transaction. The entire negotiation process is completely based on homomorphic encryption technology to ensure security.

5. According to claim 1, a data transaction security protection method based on subject-object binding relationship is characterized by: The step six further includes the following contents: Data encryption transmission According to the agreement, the owner will process the data assets and metadata with fully homomorphic encryption and send them to the user. In the transmission process, the characteristics of fully homomorphic encryption are used to achieve functions similar to segmented encrypted transmission. After receiving the data, the user uses the decryption and verification functions of the homomorphic encryption algorithm to process it, and reports any problems to the platform; Transaction monitoring and recording The platform monitors and records key node information in real time, and uses the monitoring system to monitor abnormal situations in the transaction process in real time; Once an abnormality is detected, the monitoring system will immediately issue an alarm and notify all parties to the transaction in a timely manner. At the same time, a transaction log management system will be established to record all operations and events in the transaction process in detail, and use fully homomorphic encryption technology to encrypt and store the logs to prevent log information from being stolen or tampered with, so as to facilitate future auditing and tracking.

6. The data transaction security protection method based on subject-object binding relationship according to claim 1 is characterized in that: The step seven further includes the following contents: Audit Operations After the transaction is completed, the platform will audit according to the standard process, using audit tools to review the operation records of both parties to the transaction, the transmission and use of data assets, and the implementation of security agreements; During the audit process, audit data involving sensitive information is encrypted using fully homomorphic encryption technology to ensure the security and accuracy of the audit process and prevent audit data leakage; By establishing an audit model, we can comprehensively evaluate the risk points in the transaction process; Feedback Processing Based on the audit results, a detailed audit report is provided to both parties of the transaction, including the transaction results, abnormal situations that occurred during the transaction, and suggested improvement measures for the abnormal situations; If any problems are found, the platform will take corresponding measures in a timely manner and promptly feedback the results to both parties to the transaction. At the same time, the platform sets up multiple feedback channels to collect opinions and suggestions from both parties to the transaction, uses text analysis technology to analyze and classify feedback information, and continuously optimizes transaction processes and security measures based on feedback information to improve the platform's service quality and security.

7. According to claim 1, a data transaction security protection method based on subject-object binding relationship is characterized by: The step eight further includes the following contents: Asset status update: After the transaction is completed, the asset status is updated according to the type. If it is sold, the owner is changed, and if it is authorized, the information of the authorized object is recorded. During the update process, a combination of database transactions and fully homomorphic encryption technology is used to ensure the integrity and immutability of the update. Asset Condition Monitoring and Maintenance: Regularly review and maintain asset status, and establish a data asset status monitoring system to monitor asset usage and storage status information in real time; the monitoring system uses sensors and log analysis technology to continuously collect relevant information about data assets; Use big data analysis technology to analyze asset status data and predict asset value change trends and potential risks.

8. A data transaction security protection device based on subject-object binding relationship, characterized by: Trading environment construction and basic configuration module When building a data trading platform, select servers with redundant power supplies and hot-swappable hard drives; use enterprise-level storage arrays for storage devices, support data encryption and rapid recovery; build a network architecture, use encryption technology to ensure efficient and secure transmission, set up different security areas such as transaction areas, storage areas, and management areas according to functional safety requirements, configure firewalls and IDS security devices, control access between areas according to policies, and monitor in real time to prevent intrusions; Build a basic database for data transactions, encrypt and store transaction participant information to ensure security; update the data asset catalog regularly; and revise the transaction rule base in a timely manner in accordance with laws, regulations and market changes; Subject and object information registration and review module When registering, data providers must provide corporate and / or personal identity, contact information, business license and / or identity certificate, data asset type, size, source and purpose information, and digital signature; The platform manually reviews the authenticity of the business license, and the automated review uses regular expressions to check the ID card number format; Data users register and submit personal and / or corporate information, purpose, scope and duration of use. The platform will review the qualifications and intentions, and assign a unique ID and initial password after passing. The passwords must be modified regularly, and password strength detection tools are used to ensure security. Subject-object binding relationship establishment and strengthening module Generate binding identifiers for data assets based on audit information, associate assets with owner information storage, and ensure that the relationship is close and cannot be tampered with; The metadata of data assets is embedded with owner information and encrypted to ensure clear ownership and tamper-proof. Only authorized users can decrypt and view the data. The key management system is used to strictly control the distribution of decryption keys. Transaction initiation and pre-processing module The owner or agent initiates the transaction, specifies the type, price, desired object characteristics, and term parameters, and digitally signs again to ensure authenticity and integrity; After receiving the request, the platform uses the CRC checksum algorithm to check the integrity of the parameters, compares the legality according to the rule base, and reviews the type compliance, such as checking whether the price is reasonable and whether the term is compliant; hash comparison is used to verify the status of data assets to ensure consistency with the registration information; Transaction matching and security protocol negotiation module The platform matches and screens registered users based on parameters, and uses a multi-dimensional matching algorithm combined with manual review to determine the list of potential partners; Facilitate the negotiation of security agreements between the two parties and determine encryption algorithms, authentication methods, authorization scopes, and transmission and storage security standards; Transaction execution and security measures implementation module According to the agreement, the owner transfers data assets and metadata in encrypted form, along with a binding identifier. After receiving the data, the user will decrypt and verify it according to the protocol. If there is any problem, the report will be stopped. The platform will monitor and record key nodes in real time. If the monitoring system encounters an abnormality, it will send an alarm to notify all parties in real time. Post-transaction audit and feedback processing module After the transaction is completed, the platform will audit according to the standard process and use tools to review the operations, asset status, and agreement execution of both parties; Provide reports to both parties, including transaction results, anomalies and suggested improvement measures, handle problems promptly and provide feedback, and set up multiple channels to collect feedback and optimize process measures; Data asset status update and maintenance module When a transaction is completed, the asset status is updated according to the type. If it is sold, the owner is changed. If it is authorized to use, the information of the authorized object is recorded. The transaction history changes are recorded and the integrity of the update is ensured by database transactions. The asset status is regularly reviewed and maintained to ensure that the information is accurate and timely, providing a basis for subsequent transaction management.

Images