Data element circulation method and device, medium and equipment

Abstract

The invention provides a data element circulation method and device, a medium and equipment. The method comprises the steps of auditing data elements provided by a data provider, and if it is found that the data elements do not meet preset data requirements in the auditing process, reminding the data provider to modify the data elements until the modified data elements meet the preset data requirements, issuing the data elements provided by the data provider and the corresponding data description information; providing a data use application interface; when a use application request submitted by a data demander is received, judging whether the data demander has access authority or not; if the data demander has the access permission, determining that the data demander has a data element field of the access permission, and examining and approving the use application request; and if the approval result is that the approval is passed, returning the data of the data element fields with the access authority of the data demander to the data demander. According to the invention, the security of data circulation is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data element circulation method and apparatus, medium, and equipment. Background Art

[0002] With the acceleration of digital transformation, the importance of data as a core production factor has become increasingly prominent. However, security threats in the process of data circulation, such as data leakage, tampering, and unauthorized access, have severely restricted the full realization of data value. Summary of the invention

[0003] In response to at least one of the above technical problems, an embodiment of the present invention provides a data element circulation method and apparatus, medium, and equipment.

[0004] According to a first aspect, a data element circulation method provided by an embodiment of the present invention is executed by a data circulation platform, and the method includes:

[0005] Review the data elements provided by the data provider. If it is found during the review process that the data elements do not meet the preset data requirements, remind the data provider to modify the data elements until the modified data elements meet the preset data requirements, and publish the data elements provided by the data provider and the corresponding data description information;

[0006] Providing a data use application interface so that data demanders can fill in and submit a use application request for the data elements published by the data circulation platform on the data use application interface;

[0007] Upon receiving the use application request submitted by the data demander, judging whether the data demander has access rights based on the digital certificate and corresponding role of the data demander; if the data demander has access rights, determining the data element fields to which the data demander has access rights according to the access control policy, and approving the use application request to obtain an approval result;

[0008] If the approval result is approval, the data in the data element fields to which the data demander has access rights will be returned to the data demander.

[0009] In one embodiment, the preset data requirements include data requirements in at least one aspect of completeness, accuracy and compliance; and / or the data description information includes at least one of the type, format, size, source and quality of the data element.

[0010] In one embodiment, before reviewing the data elements provided by the data provider, the method further includes:

[0011] Preprocessing the data elements provided by the data provider so that the preprocessed data meets the data format requirements and data quality requirements;

[0012] Desensitize sensitive information contained in pre-processed data elements;

[0013] Generate a session key uniquely corresponding to the data element through a key management system, and encrypt the data element after desensitizing the sensitive information contained therein using the session key and an encryption algorithm in an encryption algorithm library;

[0014] Among them, after receiving the data elements, the data demander uses the session key to decrypt the data elements; the data elements are transmitted in an encrypted manner from the data provider to the data circulation platform and from the data circulation platform to the data demander.

[0015] In one embodiment, the data requester fills in and submits the data use application request on the data use application interface, including the data requester's personal information, data description information of the required data elements, the purpose of using the data, the period of using the data, and relevant certification materials; wherein the relevant certification materials are certification materials proving the legality and rationality of the data requester's use application request;

[0016] Correspondingly, the review and approval of the use application request includes:

[0017] The identity of the data demander is verified, as well as the legality and rationality of the application request.

[0018] In one embodiment, the method further comprises:

[0019] When any data circulation subject logs into the data circulation platform, a two-factor authentication method is used to authenticate the identity of the data circulation subject; when the identity authentication is passed, a unique digital certificate is issued to the data circulation subject; wherein, the digital certificate is the identity credential of the data circulation subject in the data circulation platform; the data circulation subject is the data provider or the data demander.

[0020] In one embodiment, the method further comprises:

[0021] The access control policy is updated regularly according to the dynamic influencing factors of the data circulation subject; wherein the dynamic influencing factors include behavior, time and location, and the data circulation subject is the data provider or the data demander.

[0022] In one embodiment, the method further comprises:

[0023] Record the entire circulation process of the data elements;

[0024] Packing the circulation information corresponding to each node of the data element in the entire circulation process into a block, and adding the block to the blockchain;

[0025] Adopt smart contract technology to automatically execute the audit tracking logic of the data elements;

[0026] Provide a visual audit trail interface to display the execution results of the audit trail logic.

[0027] According to a second aspect, a data element circulation device provided by an embodiment of the present invention is deployed on a data circulation platform, and the device includes:

[0028] A data publishing module is used to review the data elements provided by the data provider. If it is found during the review process that the data elements do not meet the preset data requirements, the data provider is reminded to modify the data elements until the modified data elements meet the preset data requirements, and the data elements provided by the data provider and the corresponding data description information are published;

[0029] A usage application module is used to provide a data usage application interface, so that data demanders can fill in and submit a usage application request for the data elements released by the data circulation platform on the data usage application interface;

[0030] The permission approval module is used to determine whether the data demander has access rights based on the digital certificate and corresponding role of the data demander when receiving the use application request submitted by the data demander; if the data demander has access rights, determine the data element fields to which the data demander has access rights according to the access control policy, and approve the use application request to obtain an approval result;

[0031] The data return module is used to return the data of the data element field to which the data demander has access rights to the data demander if the approval result is approval.

[0032] According to a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method provided in the first aspect.

[0033] According to a fourth aspect, an embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0034] The data element circulation method, device, medium, and equipment provided by the embodiment of the present invention first audit the data elements provided by the data provider. If it is found during the audit process that the data elements do not meet the preset data requirements, the data provider is reminded to modify the data elements until the modified data elements meet the preset data requirements, and the data elements provided by the data provider and the corresponding data description information are published, so as to realize the release of the data elements. Then, the data demander fills in and submits the use application request for the data elements published by the data circulation platform on the data use application interface, so as to realize the application of data elements. After receiving the use application request submitted by the data demander, the data circulation platform determines whether the data demander has access rights based on the digital certificate and corresponding role of the data demander. If the data demander has access rights, the data element fields to which the data demander has access rights are determined according to the access control policy, and the use application request is approved to obtain the approval result, so as to realize the audit work. If the approval result is approved, the data of the data element fields to which the data demander has access rights is returned to the data demander, so as to realize the feedback of the data elements. It can be seen that the above process realizes the publication, application, approval and feedback of data elements, builds an end-to-end secure data exchange environment, and improves the security of data in all aspects of circulation. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a flow chart of a data element circulation method in one embodiment of the present invention;

[0036] Figure 2 It is a structural block diagram of a data element circulation device in one embodiment of the present invention. DETAILED DESCRIPTION

[0037] In a first aspect, an embodiment of the present invention provides a data element circulation method, the method being executed by a data circulation platform, see Figure 1 , the method comprises the following steps S110 to S140:

[0038] S110, reviewing the data elements provided by the data provider. If it is found during the review process that the data elements do not meet the preset data requirements, reminding the data provider to modify the data elements until the modified data elements meet the preset data requirements, and publishing the data elements provided by the data provider and the corresponding data description information;

[0039] The preset data requirements may include data requirements on at least one aspect of completeness, accuracy and compliance.

[0040] Before the data elements are released, the data circulation platform will verify and review the data elements to ensure the quality and compliance of the data, including checking the integrity, accuracy and compliance of the data elements. If there are problems with the data or it does not meet the requirements, the data circulation platform will require the data provider to modify or supplement it until the data meets the requirements, and then the data elements and data description information can be released.

[0041] In one embodiment, before reviewing the data elements provided by the data provider, the method may further include:

[0042] 11. Preprocessing the data elements provided by the data provider so that the preprocessed data meets the data format requirements and data quality requirements;

[0043] 12. Desensitize sensitive information contained in pre-processed data elements;

[0044] 13. Generate a session key uniquely corresponding to the data element through a key management system, and encrypt the data element after desensitizing the sensitive information contained therein using the session key and an encryption algorithm in an encryption algorithm library;

[0045] Among them, after receiving the data elements, the data demander uses the session key to decrypt the data elements; the data elements are transmitted in an encrypted manner from the data provider to the data circulation platform and from the data circulation platform to the data demander.

[0046] In actual scenarios, the data provider first collects and organizes the data elements that need to be published. These data elements may include various types of data, such as text, images, videos, audio, etc., and then pre-processes the data elements collected and organized by the data provider, including data cleaning, conversion, and aggregation operations, to meet the data circulation platform's requirements for data format and quality. Next, desensitize the data containing sensitive information, such as deleting, replacing, or disrupting sensitive data to protect user privacy from being leaked. The key management system generates a session key that uniquely corresponds to the data element that needs to be published this time, and uses the session key to encrypt the data element, which can prevent the data from being illegally obtained or tampered with during transmission and storage, and ensure the security of the data.

[0047] It is understandable that after receiving the data element, the data demander will use the session key to decrypt the data element to obtain the decrypted data element.

[0048] It can be seen that the embodiments of the present invention use advanced encryption algorithms to encrypt the data in circulation to ensure the security of the data during transmission. It supports multiple encryption algorithms, such as AES, RSA, ECC, etc., and can select a suitable encryption algorithm for encryption according to the importance and sensitivity of the data. The use of homomorphic encryption technology allows calculation and analysis of data without decrypting the data to meet the privacy protection requirements. Real-time encryption of data during transmission is achieved, including end-to-end encryption and transport layer encryption.

[0049] It can be seen that before sending data, a unique session key is generated using the key management system for data encryption and decryption. The encryption algorithm library is called to encrypt the data using the session key. During data transmission, data can be encrypted and transmitted using the TLS / SSL protocol. After receiving the encrypted data, the data demander uses the same session key to decrypt the data.

[0050] In addition, when data providers publish data elements through the data circulation platform, they need to provide detailed data description information, including data type, format, size, source, quality and other information, which will help data demanders better understand the data content and usage. Data providers can also set conditions such as data access rights to ensure data security and controllability.

[0051] S120, providing a data use application interface, so that the data demander can fill in and submit a use application request for the data elements published by the data circulation platform on the data use application interface;

[0052] The data description information may include at least one of the type, format, size, source and quality of the data element.

[0053] Specifically, the data demander may fill out and submit an application request on the data use application interface, including the data demander's personal information, data description information of the required data elements, the purpose of using the data, the period of using the data, and relevant supporting materials; wherein the relevant supporting materials are supporting materials that prove the legality and rationality of the data demander's application request.

[0054] Among them, supporting materials, such as work certificate, project requirements description, etc., are provided to prove the rationality and legality of the application.

[0055] S130, upon receiving the use application request submitted by the data demander, judging whether the data demander has access rights based on the digital certificate and corresponding role of the data demander; if the data demander has access rights, determining the data element fields to which the data demander has access rights according to the access control policy, and approving the use application request to obtain an approval result;

[0056] It can be seen that after receiving the use application request submitted by the data demander, the data circulation platform will determine whether the data demander has access rights based on the data demander's digital certificate and corresponding role. If the data demander has access rights, the data element fields to which the data demander has access rights will be further determined based on the access control policy. This is a more fine-grained access control.

[0057] The review and approval of the use application request may include: verifying the identity of the data demander, and verifying the legality and rationality of the use application request.

[0058] S140. If the approval result is approved, the data in the data element fields to which the data demander has access rights is returned to the data demander.

[0059] It is understood that the approval result will be notified to the data demander through the data circulation platform. If the application is approved, the data demander will obtain access rights to the data elements. If the application is rejected, the data demander will receive a rejection notice and understand the reasons for the rejection.

[0060] In one embodiment, the method may further include:

[0061] When any data circulation subject logs into the data circulation platform, a two-factor authentication method is used to authenticate the identity of the data circulation subject; when the identity authentication is passed, a unique digital certificate is issued to the data circulation subject; wherein, the digital certificate is the identity credential of the data circulation subject in the data circulation platform; the data circulation subject is the data provider or the data demander.

[0062] That is to say, when data providers or data demanders log in to the data circulation platform, they will first use two-factor authentication to authenticate their identities. Two-factor authentication methods, such as password + mobile phone verification code, password + fingerprint recognition, etc., enhance the security of identity authentication. After the identity authentication is passed, the public key infrastructure, namely PKI, and digital certificate technology can be used to issue a unique digital certificate to the data circulation subject. Among them, the lightweight directory access protocol, namely LDAP or similar identity management services, can be used to centrally manage digital certificates and identity information.

[0063] It can be seen that when the data circulation subject logs in, he enters the user name and password and authenticates his identity through two-factor authentication. After the verification is passed, the data circulation platform issues a digital certificate to the data circulation subject and stores it in a secure repository locally or in the cloud. When the data circulation platform is started, relevant information of the registered data circulation subject can be obtained.

[0064] It can be seen that after the data demander logs in to the data circulation platform, identity authentication will be carried out. After the identity authentication is passed, the data demander can fill in the use application request. After the data demander submits the use application request, the data circulation platform will determine whether the data demander has access rights based on the data demander's digital certificate and corresponding role; if the data demander has access rights, the data element fields that the data demander has access rights to will be determined according to the access control policy, and the use application request will be approved to obtain the approval result.

[0065] Among them, data demanders can query the required data elements through the search function or category browsing of the data circulation platform, and then filter and sort them according to conditions such as data type and keywords, and then determine which data requirements need to be accessed, and then fill in the corresponding use application request for these data elements.

[0066] In one embodiment, the method may further include:

[0067] The access control policy is updated regularly according to the dynamic influencing factors of the data circulation subject; wherein the dynamic influencing factors include behavior, time and location, and the data circulation subject is the data provider or the data demander.

[0068] It can be seen that the access control policy is not static and can be updated regularly based on the behavior, time and location of the data circulation subject, so that the access control policy can better meet the actual needs of the data circulation subject.

[0069] It can be seen that permission rules can be set in advance, that is, the scope of data access permissions can be set in advance based on the identity and permissions of the data circulation subject. When the data demander submits a request for use, the data demander's digital certificate and preset permission rules can be obtained to determine whether he has the permission to access specific data, thereby achieving access control to the data. It can be seen that a role-based access control strategy is introduced here to assign different data access permissions to different roles. Moreover, since fine-grained access control is supported, field-level access control can be achieved. In other words, when a data access request arrives, it is determined whether the data circulation subject has access permissions based on the digital certificate and role information of the data circulation subject. If it has access permissions, it is further determined which data fields or records it can access based on the fine-grained access control strategy.

[0070] In one embodiment, the method may further include:

[0071] Record the entire circulation process of the data elements;

[0072] Packing the circulation information corresponding to each node of the data element in the entire circulation process into a block, and adding the block to the blockchain;

[0073] Adopt smart contract technology to automatically execute the audit tracking logic of the data elements;

[0074] Provide a visual audit trail interface to display the execution results of the audit trail logic.

[0075] It can be seen that the whole process of data circulation is recorded, including the source, destination, access time, operation content and other information of the data, to achieve the traceability of the data circulation process. Blockchain technology is used to record the whole process of data circulation to ensure the authenticity and non-tamperability of the records. At each key node of data circulation, such as data sending, receiving, accessing, etc., the relevant data circulation information, such as timestamp, operation type, operation content, etc., is packaged into a block and added to the blockchain. Using smart contract technology, the rules and logic related to audit tracking are automatically executed, such as detecting abnormal operations and generating alarms. A visual audit tracking interface is provided to display the execution results of the audit tracking logic, which is also convenient for users to query and analyze historical records and understand the circulation and security status of data. At the same time, it can also support the query and analysis of historical records, providing strong support for data security management and risk prevention and control.

[0076] It can be seen that the embodiments of the present invention realize the efficient, safe and traceable circulation of data elements by combining advanced encryption technology, identity authentication technology, access control strategy, blockchain technology and smart contract technology. It has the characteristics of decentralization, non-tampering, transparent and traceable, which can reduce the security risks in the process of data circulation, protect user privacy and improve the efficiency of data circulation. At the same time, it also has the advantages of automated execution and decentralized management, which can reduce the cost and complexity of data circulation.

[0077] The embodiments of the present invention involve technical means such as data element release, data element application, identity authentication, data encryption, access control, and audit tracking, so as to achieve the goals of confirming the source of data, having a basis for data use, defining the scope of use, tracing the circulation process, and preventing security risks. An end-to-end secure data exchange environment is built to ensure the privacy protection, integrity, traceability, and compliance of data in all aspects of circulation.

[0078] In a second aspect, an embodiment of the present invention provides a data element circulation device, which is deployed on a data circulation platform. Figure 2 , the apparatus 100 may include:

[0079] The data publishing module 110 is used to review the data elements provided by the data provider. If it is found during the review process that the data elements do not meet the preset data requirements, the data provider is reminded to modify the data elements until the modified data elements meet the preset data requirements, and the data elements provided by the data provider and the corresponding data description information are published;

[0080] The use application module 120 is used to provide a data use application interface, so that the data demander can fill in and submit a use application request for the data elements released by the data circulation platform on the data use application interface;

[0081] The permission approval module 130 is used to determine whether the data demander has access rights based on the digital certificate and corresponding role of the data demander when receiving the use application request submitted by the data demander; if the data demander has access rights, determine the data element fields to which the data demander has access rights according to the access control policy, and approve the use application request to obtain an approval result;

[0082] The data return module 140 is used to return the data of the data element fields to which the data demander has access rights to the data demander if the approval result is approval.

[0083] In one embodiment, the preset data requirements include data requirements in at least one aspect of completeness, accuracy and compliance; and / or the data description information includes at least one of the type, format, size, source and quality of the data element.

[0084] In one embodiment, before reviewing the data elements provided by the data provider, the data publishing module is also used to: pre-process the data elements provided by the data provider so that the pre-processed data meet the data format requirements and data quality requirements; desensitize the sensitive information contained in the pre-processed data elements; generate a session key uniquely corresponding to the data element through a key management system, and encrypt the data element containing the desensitized sensitive information using the session key and an encryption algorithm in an encryption algorithm library; wherein the data demander decrypts the data element using the session key after receiving the data element; and an encrypted transmission method is used in the transmission of the data elements from the data provider to the data circulation platform and from the data circulation platform to the data demander.

[0085] In one embodiment, the use application request filled in and submitted by the data demander on the data use application interface includes the data demander's personal information, data description information of the required data elements, the purpose of using the data, the period of use of the data, and relevant supporting materials; wherein the relevant supporting materials are supporting materials that prove the legality and rationality of the use application request of the data demander; correspondingly, the approval of the use application request in the authority approval module includes: verifying the identity of the data demander, and verifying the legality and rationality of the use application request.

[0086] In one embodiment, the device may further include:

[0087] The identity authentication module is used to use a two-factor authentication method to authenticate the identity of any data circulation subject when the data circulation subject logs into the data circulation platform; when the identity authentication is passed, a unique corresponding digital certificate is issued to the data circulation subject; wherein, the digital certificate is the identity credential of the data circulation subject in the data circulation platform; the data circulation subject is the data provider or the data demander.

[0088] In one embodiment, the device may further include:

[0089] The policy update module is used to regularly update the access control policy according to the dynamic influencing factors of the data circulation subject; wherein the dynamic influencing factors include behavior, time and location, and the data circulation subject is the data provider or the data demander.

[0090] In one embodiment, the device may further include:

[0091] The audit tracking module is used to record the entire circulation process of the data element; package the circulation information corresponding to each node of the data element in the entire circulation process into a block, and add the block to the blockchain; use smart contract technology to automatically execute the audit tracking logic of the data element; and provide a visual audit tracking interface to display the execution results of the audit tracking logic.

[0092] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0093] In a third aspect, an embodiment of the present invention provides a computer-readable medium, on which computer instructions are stored. When the computer instructions are executed by a processor, the processor executes the method provided in the first aspect.

[0094] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0095] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0096] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0097] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0098] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0099] It is understandable that the explanation, specific implementation methods, beneficial effects, examples, etc. of the relevant contents in the computer-readable medium provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0100] In a fourth aspect, an embodiment of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any embodiment of the specification.

[0101] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the computing device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0102] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0103] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, widgets, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0104] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data element circulation method, characterized in that: The method is performed by a data circulation platform, and the method includes: Review the data elements provided by the data provider. If it is found during the review process that the data elements do not meet the preset data requirements, remind the data provider to modify the data elements until the modified data elements meet the preset data requirements, and publish the data elements provided by the data provider and the corresponding data description information; Providing a data use application interface so that data demanders can fill in and submit a use application request for the data elements published by the data circulation platform on the data use application interface; Upon receiving the use application request submitted by the data demander, judging whether the data demander has access rights based on the digital certificate and corresponding role of the data demander; if the data demander has access rights, determining the data element fields to which the data demander has access rights according to the access control policy, and approving the use application request to obtain an approval result; If the approval result is approval, the data in the data element fields to which the data demander has access rights will be returned to the data demander.

2. The method according to claim 1, characterized in that The preset data requirements include data requirements in at least one aspect of completeness, accuracy and compliance; and / or the data description information includes at least one of the type, format, size, source and quality of the data element.

3. The method according to claim 1, characterized in that Before reviewing the data elements provided by the data provider, the method further includes: Preprocessing the data elements provided by the data provider so that the preprocessed data meets the data format requirements and data quality requirements; Desensitize sensitive information contained in pre-processed data elements; Generate a session key uniquely corresponding to the data element through a key management system, and encrypt the data element after desensitizing the sensitive information contained therein using the session key and an encryption algorithm in an encryption algorithm library; Among them, after receiving the data elements, the data demander uses the session key to decrypt the data elements; the data elements are transmitted in an encrypted manner from the data provider to the data circulation platform and from the data circulation platform to the data demander.

4. The method according to claim 1, characterized in that: The data requester fills in and submits the data use application request on the data use application interface, including the data requester's personal information, data description information of the required data elements, the purpose of using the data, the period of using the data, and relevant certification materials; wherein the relevant certification materials are certification materials proving the legality and rationality of the data requester's use application request; Correspondingly, the review and approval of the use application request includes: The identity of the data demander is verified, and the legality and rationality of the application request are verified.

5. The method according to claim 1, characterized in that Also includes: When any data circulation subject logs into the data circulation platform, a two-factor authentication method is used to authenticate the identity of the data circulation subject; when the identity authentication is passed, a unique digital certificate is issued to the data circulation subject; wherein, the digital certificate is the identity credential of the data circulation subject in the data circulation platform; the data circulation subject is the data provider or the data demander.

6. The method according to claim 1, characterized in that Also includes: The access control policy is updated regularly according to the dynamic influencing factors of the data circulation subject; wherein the dynamic influencing factors include behavior, time and location, and the data circulation subject is the data provider or the data demander.

7. The method according to claim 1, characterized in that Also includes: Record the entire circulation process of the data elements; Packing the circulation information corresponding to each node of the data element in the entire circulation process into a block, and adding the block to the blockchain; Adopt smart contract technology to automatically execute the audit tracking logic of the data elements; Provide a visual audit trail interface to display the execution results of the audit trail logic.

8. A data element circulation device, characterized in that: The device is deployed on a data circulation platform, and includes: A data publishing module is used to review the data elements provided by the data provider. If it is found during the review process that the data elements do not meet the preset data requirements, the data provider is reminded to modify the data elements until the modified data elements meet the preset data requirements, and the data elements provided by the data provider and the corresponding data description information are published; A usage application module is used to provide a data usage application interface, so that data demanders can fill in and submit a usage application request for the data elements released by the data circulation platform on the data usage application interface; The permission approval module is used to determine whether the data demander has access rights based on the digital certificate and corresponding role of the data demander when receiving the use application request submitted by the data demander; if the data demander has access rights, determine the data element fields to which the data demander has access rights according to the access control policy, and approve the use application request to obtain an approval result; The data return module is used to return the data of the data element field to which the data demander has access rights to the data demander if the approval result is approval.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device, characterized in that The method comprises a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images