A data circulation method and device based on data usage control

Abstract

The present invention discloses a data circulation method and device based on data usage control. The present invention implements comprehensive analysis of the identity authentication information and data access request of the data requester, verifies the identity authentication information provided by the data requester, and after successful verification, compares the location information of the requester with the security access range to determine whether to authorize access. If the data requester is outside the set security access range, the location of the data requester is further matched with the historical location information. If the match fails, it is determined that the data requester is accessing from a different location. If it is determined to be an abnormal access, the hidden danger assessment index of the requester is analyzed, and this is used as the final basis for whether to authorize access. The present invention solves the problem that most of the prior art adopts fixed data usage and access strategies, resulting in the risk of unauthorized access and abuse of data during circulation, and the level of sophistication is low.

Description

Technical Field

[0001] The present invention relates to the technical field of data circulation, and in particular to a data circulation method and device based on data usage control. Background Art

[0002] In today's digital age, data has become one of the most valuable assets for businesses and individuals. With the rapid development of Internet technology, the generation, storage, processing and transmission of data have become increasingly frequent, and the issues of data security and privacy protection have become increasingly prominent; therefore, how to safely and effectively manage and control data circulation has become an urgent problem to be solved.

[0003] However, the data circulation method in the prior art still has the following deficiencies:

[0004] Most existing technologies use fixed data usage and access policies, which makes data vulnerable to unauthorized access and abuse during circulation and has a low level of sophistication;

[0005] Data is vulnerable to hacker attacks and abuse by insiders during transmission and storage, which increases the risk of data leakage. The existing technology usually uses more conventional encryption methods for encryption, such as AES, DES and 3DES. Although this encryption method plays a protective role, its security is still not fully guaranteed.

[0006] To this end, a data circulation method and device based on data usage control are introduced. Summary of the invention

[0007] In view of this, the present invention provides a data circulation method and device based on data usage control to solve the problems raised by the above background technology.

[0008] The object of the present invention can be achieved by the following technical solution: A data circulation method based on data usage control, comprising:

[0009] Data provision: The data provider sends the data to the data storage center and defines the data usage policy. After the definition is completed, the uploaded data is associated with the usage policy and stored in the data storage center;

[0010] Data request: The data requester issues a data access request and provides the corresponding identity authentication information of the requester;

[0011] Circulation control: Comprehensively analyze the data requester's authentication information and data access request, and execute corresponding steps to decide whether to authorize the data requester to access;

[0012] Storage center: After the data provider sends the data to the data storage center, the data is encrypted based on the preset encryption rules;

[0013] Usage audit: records access-related information for each data access; access-related information includes access time, requester identity, and accessed data.

[0014] In some embodiments, a data usage policy is defined, specifically:

[0015] Extract the properties of the data uploaded by the data provider and classify them, and preset a set of basic policy templates corresponding to different types of data; based on the classification results of the data uploaded by the current data provider, obtain the basic policy template set corresponding to the uploaded data;

[0016] The top three policy templates in terms of usage frequency are extracted from the basic policy template set corresponding to the uploaded data; and pushed to the data provider corresponding to the currently uploaded data. The data provider selects a set of policy templates from the top three policy templates as basic templates, and customizes the basic templates as the data usage policy for the currently uploaded data. The data usage policy includes data access rights, data sharing scope, and data retention period.

[0017] In some embodiments, corresponding steps are performed to determine whether to authorize the data requester to access the data, specifically:

[0018] S1: Verify the identity authentication information provided by the data requester. If the verification succeeds, execute step S2. If the verification fails, execute step S3.

[0019] S2: After successful verification, a location feedback instruction is sent to the data requester. The data requester confirms the location of the data access request issued by the data requester, and compares the location with the set security access range. If the location is within the set security access range, the data requester is determined to have safe access and is authorized to access. If the location is outside the set security access range, step S2-201 is executed;

[0020] S3: Mark the data access request issued by the data requester as an abnormal access request, and restrict the data access request of the requester within a set time period.

[0021] In some embodiments, the specific execution steps of step S2-201 are:

[0022] S2-201: Match the location of the data requester with the historical location information. If the match is successful, it is determined that the data requester is accessing securely. If the match fails, it is determined that the data requester is accessing remotely, and step S2-202 is executed;

[0023] S2-202: Obtain the length of stay of the data requester, where the length of stay starts from the time the data requester enters the data storage center and ends when the data access request is issued, and the length of the time interval is used as the length of stay of the data requester; count the number of access requests of the data requester within the set time period;

[0024] Mark the time point when the data requester sends the data access request, match the marked time point with the set regular time range, and preset matching failure and matching success to correspond to a set of weight coefficients of the stay time and the number of access requests respectively;

[0025] Based on the matching results, the length of stay and the number of access requests of the data requester are multiplied by the corresponding weight coefficients respectively, and then the sum is calculated to obtain the hidden danger assessment index of the data requester;

[0026] Based on the data usage policy of the data requester for accessing data, preset reference hidden danger assessment indexes for different data in the comparison process; compare the hidden danger assessment index of the data requester with the corresponding reference hidden danger assessment index; if the hidden danger assessment index of the data requester is less than the corresponding reference hidden danger assessment index, the data requester is judged to have safe access, otherwise, execute step S3.

[0027] In some embodiments, data is encrypted based on a preset encryption rule, specifically:

[0028] M1: Based on the nature of the uploaded data, different keys are generated for different categories; random keys are generated for the data uploaded by the data provider; random keys are composed of numbers, symbols and letters;

[0029] M2: After generating the corresponding random key, extract the numbers in the random key as the numbers to be processed, and convert the letters and symbols in the random key into numbers based on the preset conversion rules;

[0030] M3: After the conversion in step M2 is completed, the numbers to be processed are combined and randomly shuffled to obtain a new string of number combinations. Based on the number combinations, encryption graphs 1 and 2 of the uploaded data are constructed;

[0031] M4: Scan the uploaded data, extract all contents except text content from the uploaded data, and encrypt them using encryption pattern 1; encrypt the text content in the uploaded data using encryption pattern 2.

[0032] In some embodiments, the letters and symbols in the random key are converted into numbers based on preset conversion rules, specifically: the numbers corresponding to different letters and symbols are set in the preset conversion rules, and according to the preset adjustment time interval, when the preset adjustment time interval is reached, the numbers corresponding to different letters and symbols are adjusted.

[0033] In some embodiments, an encrypted graph of uploaded data is constructed based on a combination of digits, specifically:

[0034] M3-301: extract the first three groups of numbers from the number combination, and substitute them into the preset encryption formula for calculation, so as to obtain three groups of calculated numbers, and fill the three groups of calculated numbers into the pre-built encryption box respectively, and after filling, obtain the encrypted figure 1;

[0035] M3-302: Based on step M3-301, extract the remaining numbers in the number combination, first count the number of the remaining numbers, and after the counting is completed, first construct a plane rectangular coordinate system, and draw position points on the x-axis of the plane rectangular coordinate system according to the corresponding sorting positions of the remaining numbers in the number combination, and after the drawing is completed, continue to draw corresponding value points with the specific numbers of each position point as the value;

[0036] After all the numerical points are drawn, use a straight line segment to connect two adjacent groups of numerical points, draw a circle with the length of the straight line segment between the two adjacent groups of numerical points as the diameter, and use the straight line segment as the interception boundary to randomly intercept a semicircle until all the interceptions are completed. The intercepted figure is used as the encrypted figure 2.

[0037] In some embodiments, a data circulation device based on data usage control includes:

[0038] Data upload module: The data provider sends the data to the data storage center and defines the data usage policy. After the definition is completed, the uploaded data is associated with the usage policy and stored in the data storage center;

[0039] Data access module: The data requester issues a data access request and provides the corresponding identity authentication information of the requester;

[0040] Access control module: conducts a comprehensive analysis of the data requester's identity authentication information and data access request, and executes corresponding steps to decide whether to authorize the data requester to access;

[0041] Data storage module: build a data storage center and encrypt data according to preset encryption rules;

[0042] Data audit module: records access-related information for each data access; access-related information includes access time, requester identity, and accessed data.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present invention verifies the identity authentication information provided by the data requester by comprehensively analyzing the identity authentication information and data access request of the data requester. After successful verification, the location information of the requester is compared with the security access range to determine whether to authorize access. If the data requester is outside the set security access range, the location of the data requester is further matched with the historical location information. If the match fails, it is determined that the data requester is accessing from a different location. If it is determined to be an abnormal access, the hidden danger assessment index of the requester is analyzed and used as the final basis for whether to authorize access. This solves the problem that most of the existing technologies adopt fixed data use and access strategies, which leads to the risk of unauthorized access and abuse of data during circulation and the low level of sophistication.

[0045] The present invention generates a corresponding random key based on the classification of the properties of the uploaded data, and uses a preset conversion rule to digitally convert the letters and symbols in the key, thereby constructing an encryption pattern 1 and an encryption pattern 2, and performing targeted encryption processing on different parts of the uploaded data, thereby solving the problem that the security of the encryption is still not fully guaranteed by using a more conventional encryption method in the prior art, and improving the security of data storage and transmission;

[0046] The present invention classifies the data uploaded by the data provider by extracting its properties, presets a set of basic policy templates corresponding to different types of data, extracts the top three policy templates with the highest number of uses from the basic policy template set corresponding to the uploaded data, and pushes them to the data provider. The data provider selects one set from these policy templates as the basic template, and after customizing the basic template, uses it as the data usage policy for the currently uploaded data, thereby ensuring that the data is properly protected according to its sensitivity and purpose;

[0047] The present invention limits the data access requests of the requester within a set time period for abnormal access requests, thereby avoiding frequent operations by the data requester. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0049] Figure 1 is a flow chart of the present invention;

[0050] Figure 2 It is a device diagram of the present invention;

[0051] Figure 3A schematic diagram of an encrypted graph 1 in the present invention;

[0052] Figure 4 It is a schematic diagram of encrypted image 2 in the present invention. DETAILED DESCRIPTION

[0053] Several embodiments of the present application will be described in more detail below with reference to the accompanying drawings so that those skilled in the art can implement the present application. The present application can be embodied in many different forms and purposes and should not be limited to the embodiments described herein. These embodiments are provided to make the present application comprehensive and complete, and to fully convey the scope of the present application to those skilled in the art. The embodiments do not limit the present application.

[0054] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the relevant art and / or the context of this specification, and will not be interpreted in an idealized or overly formal sense unless explicitly defined as such herein.

[0055] Example 1

[0056] See also Figure 1 As shown, a data circulation method based on data usage control includes:

[0057] Data provision: Data providers send data to the data storage center through a secure data upload interface and define data usage policies. After the definition is completed, the uploaded data is associated with the usage policy and stored in the data storage center;

[0058] Data providers use pre-built upload tools or APIs to transfer data files to the data storage center. At the same time, encryption protocols such as SSL / TLS are used during the data upload process to ensure the security of data transmission.

[0059] Define data usage policies, specifically:

[0060] Extract and classify the data uploaded by the data provider, such as personal identification information and financial data;

[0061] Preset a set of basic policy templates corresponding to different types of data; create different levels of basic policy templates according to different types of data; based on the classification results of the data uploaded by the current data provider, obtain the basic policy template set corresponding to the uploaded data;

[0062] Extract the top three policy templates with the highest number of uses from the basic policy template set corresponding to the uploaded data;

[0063] Each policy template includes settings for data access permissions, data retention period, and data sharing scope.

[0064] The data provider will then select a set of policy templates from the top three as the basic templates, and customize the basic templates to use as the data usage policy for the currently uploaded data. The data usage policy includes data access rights, data sharing scope, and data retention period.

[0065] It should be noted that, in summary, data providers can choose the most appropriate data usage policy for their uploaded data and can adjust it according to actual conditions to ensure the security and compliance of data use.

[0066] Data request: The data requester sends a data access request through the request interface and provides the corresponding authentication information of the requester; the authentication information includes the user name, password and API key;

[0067] Circulation control: Comprehensively analyze the data requester's authentication information and data access request, and execute corresponding steps to decide whether to authorize the data requester to access; for authorized access, generate an access token for the data requester to access the corresponding data within a set time period;

[0068] Specifically:

[0069] S1: Verify the identity authentication information provided by the data requester. If the verification succeeds, execute step S2. If the verification fails, execute step S3.

[0070] S1-101: Receive the user name, password and API key submitted by the data requester, confirm that the submitted user name and password match the user credentials stored in the system, and determine whether the data requester's permissions meet the permission scope and sharing scope set in the data usage policy. If the match is successful and the data usage policy is met, the verification is considered successful;

[0071] S2: After successful verification, a location feedback instruction is sent to the data requester. The data requester confirms the location of the data access request issued by the data requester, and compares the location with the set security access range. If the location is within the set security access range, the data requester is determined to have safe access and is authorized to access. If the location is outside the set security access range, step S2-201 is executed;

[0072] S2-201: Match the location of the data requester with the historical location information. If the match is successful, it is determined that the data requester is accessing securely. If the match fails, it is determined that the data requester is accessing remotely, and step S2-202 is executed;

[0073] S2-202: Obtain the length of stay of the data requester. The length of stay starts from the time when the data requester enters the data storage center and ends when the data access request is issued. The length of this time interval is used as the length of stay of the data requester. The length of stay is in hours.

[0074] The longer they stay, the more likely they are looking for information or trying to bypass security measures, and the higher the risk level.

[0075] Count the number of access requests made by the data requester within a set time period;

[0076] Frequent attempts by users to access the system within a short period of time, especially during non-business hours, may indicate an automated attack or unauthorized access attempts;

[0077] Mark the time point when the data requester sends the data access request, match the marked time point with the set regular time range, and preset matching failure and matching success to correspond to a set of weight coefficients of the stay time and the number of access requests respectively;

[0078] The weight coefficients of the stay time and the number of access requests when the match fails are greater than the weight coefficients of the stay time and the number of access requests when the match succeeds;

[0079] Based on the matching results, the length of stay and the number of access requests of the data requester are multiplied by the corresponding weight coefficients respectively, and then the sum is calculated to obtain the hidden danger assessment index of the data requester;

[0080] Based on the data use policy of the data requester for accessing the data, a reference hidden danger assessment index of different data in the comparison process is preset; the hidden danger assessment index of the data requester is compared with the corresponding reference hidden danger assessment index, and if the hidden danger assessment index of the data requester is less than the corresponding reference hidden danger assessment index, the data requester is determined to have safe access, otherwise, step S3 is executed;

[0081] For example, if the data usage policy setting for accessing data has a high access permission and a small sharing scope, the reference risk assessment index value for the data should be set relatively low to improve the security of the data. The specific value is set by the technical staff in a targeted manner.

[0082] S3: Mark the data access request issued by the data requester as an abnormal access request, and restrict the data access request of the requester within a set time period;

[0083] For example, the requester is restricted from making another data access request to the data within 60 seconds or 3 minutes;

[0084] Storage center: After the data provider sends the data to the data storage center, the data is encrypted based on the preset encryption rules;

[0085] Specifically:

[0086] M1: Based on the nature of the uploaded data, different keys are generated for different categories. A machine learning algorithm is used to randomly generate a random key for the data uploaded by the data provider. The random key is composed of numbers, symbols and letters.

[0087] For example, the key composition for personal identity information is numbers plus letters, and the key composition for financial data is numbers + letters + symbols;

[0088] The key length range is set between 8 and 12 and is randomly generated;

[0089] M2: After generating the corresponding random key, extract the numbers in the random key as the numbers to be processed, and convert the letters and symbols in the random key into numbers based on the preset conversion rules;

[0090] M2-201: The numbers corresponding to different letters and symbols are set in the preset conversion rules, and the numbers corresponding to different letters and symbols are adjusted according to the preset adjustment time interval when the preset adjustment time interval point is reached;

[0091] For example, the conversion rules during the last adjustment time interval are as follows:

[0092] For example, A / a -> 1, B / b -> 3, C / c -> 5, etc.; #-> 14, &-> 15;

[0093] The preset adjustment interval is to adjust the conversion rules once every 24 hours. After 24 hours, the conversion rules will be updated.

[0094] For example: A / a -> 7, B / b -> 1, C / c -> 3, etc.; #->18, &->14.

[0095] Regularly updating the transformation rules increases the complexity of the key, making it difficult for attackers to predict and crack it;

[0096] M3: After the conversion in step M2 is completed, the numbers to be processed are combined and randomly shuffled to obtain a new string of number combinations. Based on the number combinations, an encrypted graph of the uploaded data is constructed;

[0097] M3-301: Extract the first three groups of numbers from the number combination and substitute them into the preset encryption formula for calculation. The preset encryption formula is set to , u represents the corresponding values ​​of the three groups of numbers; thus, three groups of calculated numbers are obtained, and the three groups of calculated numbers are filled into the pre-constructed encryption box respectively. The encryption box is composed of three groups of squares; after the filling is completed, the encrypted figure 1 is obtained;

[0098] Additional explanations, for example,

[0099] Number combination: [5, 2, 8, 3, 9]; extract the first three groups of numbers in this combination, apply the preset encryption formula, and construct an encrypted graph;

[0100] Extract the first three groups of numbers: 5, 2, 8; and substitute them into the encryption formula Calculate and get three sets of numbers: 12, 6, 18;

[0101] Construct an encryption frame consisting of three groups of squares. The size of each square is the same. After calculation, fill the numbers 12, 6, and 18 into the encryption frame. Fill the first square with the number 12, the second square with the number 6, and the third square with the number 18.

[0102] M3-302: Based on step M3-301, extract the remaining numbers in the number combination, first count the number of the remaining numbers, and after the counting is completed, first construct a plane rectangular coordinate system, and draw position points on the x-axis of the plane rectangular coordinate system according to the corresponding sorting positions of the remaining numbers in the number combination. The closer the sorting position is, the closer the position point is to the origin; after the drawing is completed, continue to draw the corresponding value points with the specific numbers of each position point as the value;

[0103] After all the numerical points are drawn, two adjacent groups of numerical points are connected by straight line segments, and a circle is drawn with the length of the straight line segment between the two adjacent groups of numerical points as the diameter, and the straight line segment is used as the interception boundary, and a semicircle is randomly intercepted until all the interceptions are completed, and the intercepted figure is used as the encrypted figure 2;

[0104] Additional explanations, for example,

[0105] Suppose the remaining numbers in the combination are {4,7,2,9,5}. In this example, the number of remaining numbers is the total number of numbers in the combination, which is 5.

[0106] Plot the position points on the x-axis according to the sorting position of each number in the number combination. The first number 4 corresponds to point 1 on the x-axis, the second number 7 corresponds to point 2, and so on.

[0107] At each location point, draw a numerical point on the y-axis according to the actual value of the number. The first number is 4, so draw a point with a height of 4 at the position x=1:

[0108] Draw the point (1, 4) at x=1, y=4; draw the point (2, 7) at x=2, y=7; draw the point (3, 2) at x=3, y=2; draw the point (4, 9) at x=4, y=9; draw the point (5, 5) at x=5, y=5;

[0109] Connect point (1, 4) and point (2, 7); Connect point (2, 7) and point (3, 2); Connect point (3, 2) and point (4, 9); Connect point (4, 9) and point (5, 5);

[0110] Draw a circle with the straight-line distance between point (1, 4) and point (2, 7) as its diameter, and randomly intercept a semicircle;

[0111] Draw a circle with the straight-line distance between point (2, 7) and point (3, 2) as its diameter, and randomly intercept a semicircle;

[0112] Draw a circle with the straight-line distance between point (3, 2) and point (4, 9) as the diameter, and randomly intercept the semicircle;

[0113] Draw a circle with the straight line distance between point (4, 9) and point (5, 5) as the diameter, and randomly intercept the semicircle;

[0114] The intercepted graphic is thus used as encrypted graphic 2.

[0115] M4: Scan the uploaded data and extract all contents except text from the uploaded data; all contents include numbers, pictures, videos, etc., and extract other contents except text; and encrypt them using encryption pattern 1; encrypt the text content in the uploaded data using encryption pattern 2;

[0116] Usage audit: records access-related information for each data access; access-related information includes access time, requester identity, and accessed data;

[0117] It is also used to regenerate the encryption graph of the data according to steps M1-M4 when the corresponding data triggers an abnormal access request, and replace the old encryption graph for updating;

[0118] It is also used to analyze the access frequency of uploaded data within a set time period. The data provider presets the maximum allowed access frequency of uploaded data within the set time period. If the access frequency of uploaded data within a set time period is higher than the preset maximum allowed access frequency, a policy adjustment signaling is triggered and sent to the data provider to adjust the data usage policy.

[0119] Example 2

[0120] See also Figure 2 As shown, based on the data circulation method based on data usage control provided in Example 1 of the present application, Example 2 of the present application proposes a data circulation device based on data usage control. Example 2 is only a preferred method of Example 1, and the implementation of Example 2 will not affect the independent implementation of Example 1.

[0121] Specifically, the data circulation device based on data usage control provided in Embodiment 2 of the present application is different in that it includes a data upload module, a data access module, an access control module, a data storage module, and a data audit module;

[0122] The data upload module is used by data providers to send data to the data storage center and define data usage policies. After the definition is completed, the uploaded data is associated with the usage policy and stored in the data storage center;

[0123] The data access module is used by the data requester to issue a data access request and provide the identity authentication information of the corresponding requester;

[0124] The access control module is used to comprehensively analyze the data requester's identity authentication information and data access request, and execute corresponding steps to decide whether to authorize the data requester to access;

[0125] The data storage module is used to build a data storage center and encrypt data according to preset encryption rules;

[0126] The data audit module is used to record access-related information for each data access; access-related information includes access time, requester identity, and accessed data.

[0127] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A data circulation method based on data usage control, characterized in that: include: Data provision: The data provider sends the data to the data storage center and defines the data usage policy. After the definition is completed, the uploaded data is associated with the usage policy and stored in the data storage center; Data request: The data requester issues a data access request and provides the corresponding identity authentication information of the requester; Circulation control: Comprehensively analyze the data requester's authentication information and data access request, and execute corresponding steps to decide whether to authorize the data requester to access; Storage center: After the data provider sends the data to the data storage center, the data is encrypted based on the preset encryption rules; The data is encrypted based on the preset encryption rules, specifically: M1: Based on the nature of the uploaded data, different keys are generated for different categories; random keys are generated for the data uploaded by the data provider; random keys are composed of numbers, symbols and letters; M2: After generating the corresponding random key, extract the numbers in the random key as the numbers to be processed, and convert the letters and symbols in the random key into numbers based on the preset conversion rules; The numbers corresponding to different letters and symbols are set in the preset conversion rules, and the numbers corresponding to different letters and symbols are adjusted according to the preset adjustment time interval when the preset adjustment time interval point is reached; M3: After the conversion in step M2 is completed, the numbers to be processed are combined and randomly shuffled to obtain a new string of number combinations. Based on the number combinations, encryption graphs 1 and 2 of the uploaded data are constructed; M3-301: extract the first three groups of numbers from the number combination, and substitute them into the preset encryption formula for calculation, so as to obtain three groups of calculated numbers, and fill the three groups of calculated numbers into the pre-built encryption box respectively, and after filling, obtain the encrypted figure 1; M3-302: Based on step M3-301, extract the remaining numbers in the number combination, first count the number of the remaining numbers, and after the counting is completed, first construct a plane rectangular coordinate system, and draw position points on the x-axis of the plane rectangular coordinate system according to the corresponding sorting positions of the remaining numbers in the number combination, and after the drawing is completed, continue to draw corresponding value points with the specific numbers of each position point as the value; After all the numerical points are drawn, two adjacent groups of numerical points are connected by straight line segments, and a circle is drawn with the length of the straight line segment between the two adjacent groups of numerical points as the diameter, and the straight line segment is used as the interception boundary, and a semicircle is randomly intercepted until all the interceptions are completed, and the intercepted figure is used as the encrypted figure 2; M4: Scan the uploaded data, extract all contents except text content from the uploaded data, and encrypt them using encryption pattern 1; encrypt the text content in the uploaded data using encryption pattern 2; Usage audit: record access-related information for each data access; Access-related information includes the time of access, the identity of the requester, and the data accessed.

2. A data circulation method based on data usage control according to claim 1, characterized in that: Define data usage policies, specifically: Extract the properties of the data uploaded by the data provider and classify them, and preset a set of basic policy templates corresponding to different types of data; based on the classification results of the data uploaded by the current data provider, obtain the basic policy template set corresponding to the uploaded data; Extract the top three policy templates with the highest number of uses from the basic policy template set corresponding to the uploaded data; The data provider will then select a set of policy templates from the top three policy templates as the basic templates, and customize the basic templates as the data usage policy for the currently uploaded data. Data usage policies include data access permissions, data sharing scope, and data retention period.

3. A data circulation method based on data usage control according to claim 1, characterized in that: Execute the corresponding steps to decide whether to authorize the data requester to access, specifically: S1: Verify the identity authentication information provided by the data requester. If the verification succeeds, execute step S2. If the verification fails, execute step S3. S2: After successful verification, a location feedback instruction is sent to the data requester. The data requester confirms the location of the data access request issued by the data requester, and compares the location with the set security access range. If the location is within the set security access range, the data requester is determined to have safe access and is authorized to access. If the location is outside the set security access range, step S2-201 is executed; S3: Mark the data access request issued by the data requester as an abnormal access request, and restrict the data access request of the requester within a set time period.

4. A data circulation method based on data usage control according to claim 3, characterized in that: The specific execution steps of step S2-201 are: S2-201: Match the location of the data requester with the historical location information. If the match is successful, it is determined that the data requester is accessing securely. If the match fails, it is determined that the data requester is accessing remotely, and step S2-202 is executed; S2-202: Obtain the length of stay of the data requester. The length of stay starts from the time when the data requester enters the data storage center and ends when the data access request is issued. The length of this time interval is used as the length of stay of the data requester. Count the number of access requests made by the data requester within a set time period; Mark the time point when the data requester sends the data access request, match the marked time point with the set regular time range, and preset matching failure and matching success to correspond to a set of weight coefficients of the stay time and the number of access requests respectively; Based on the matching results, the length of stay and the number of access requests of the data requester are multiplied by the corresponding weight coefficients respectively, and then the sum is calculated to obtain the hidden danger assessment index of the data requester; Based on the data usage policy of the data requester for accessing data, preset reference hidden danger assessment indexes for different data in the comparison process; compare the hidden danger assessment index of the data requester with the corresponding reference hidden danger assessment index; if the hidden danger assessment index of the data requester is less than the corresponding reference hidden danger assessment index, the data requester is judged to have safe access, otherwise, execute step S3.

5. A data circulation device based on data usage control, applied to a data circulation method based on data usage control proposed in any one of claims 1 to 4, characterized in that: include: Data upload module: The data provider sends the data to the data storage center and defines the data usage policy. After the definition is completed, the uploaded data is associated with the usage policy and stored in the data storage center; Data access module: The data requester issues a data access request and provides the corresponding identity authentication information of the requester; Access control module: conducts a comprehensive analysis of the data requester's identity authentication information and data access request, and executes corresponding steps to decide whether to authorize the data requester to access; Data storage module: build a data storage center and encrypt data according to preset encryption rules; Data audit module: records access-related information for each data access; Access-related information includes the time of access, the identity of the requester, and the data accessed.

Images