Data storage method and device, electronic equipment and storage medium

Abstract

The invention provides a data storage method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of data storage. The data storage method comprises the following steps: acquiring original data of a data supplier, and a set security level and an identification security level of the original data; encrypting the original data to obtain ciphertext data, and respectively storing the original data and the ciphertext data into different storage areas of the data lake; extracting path information of the ciphertext data, and encrypting the path information segment by segment based on a set security level and an identification security level to obtain a path ciphertext; and based on the path ciphertext, generating a block chain docked with the data demander. The method and the device are used for at least solving the problems of low security and privacy of data storage and management and high storage pressure in related technologies. The method is suitable for data storage and management scenes.

Description

Technical Field

[0001] The present invention relates to the field of data storage technology, and in particular to a data storage method, device, electronic device and computer-readable storage medium. Background Art

[0002] The main idea of ​​a data lake is to store all raw data in a unified manner, usually in a system or repository in a natural format, which helps to configure data in various modes and structures, such as object blocks or files. In terms of physical implementation, a data lake is a data storage platform used to centrally store massive, multi-source, and multi-type data.

[0003] With the development of blockchain technology, using the encryption properties of blockchain technology itself to store data has gradually become a trend. Blockchain technology can effectively protect data security and data privacy.

[0004] However, for the data lake data storage model, ensuring the security of data storage is a major difficulty. The large-scale aggregation of multi-party original data and the deep coupling with the business will cause serious consequences if the data in the data lake is stolen or tampered with. For the blockchain storage model, under the premise of large-scale multi-party original data, higher requirements are placed on the computing and storage capabilities of the equipment. When the system operates for a long time, the massive and repeated block data will bring great storage pressure. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a data storage method, device, electronic device and computer-readable storage medium in response to the above-mentioned deficiencies in the prior art. The method can realize intelligent and secure data storage, effectively alleviate the pressure of massive and repeated block data storage, and effectively improve the efficiency and data security of data storage and data management.

[0006] In a first aspect, the present invention provides a data storage method, including: obtaining original data of a data supplier, a set confidentiality level and an identification confidentiality level of the original data; encrypting the original data to obtain ciphertext data, and storing the original data and the ciphertext data in different storage areas of a data lake, respectively; extracting path information of the ciphertext data, and based on the set confidentiality level and the identification confidentiality level, encrypting the path information in segments to obtain a path ciphertext; based on the path ciphertext, generating a blockchain connected to a data demander.

[0007] Preferably, the method of obtaining the original data of the data supplier, the set confidentiality level of the original data and the identification confidentiality level specifically includes: obtaining the original data of the data supplier and the set confidentiality level of the original data; identifying the original data based on a supply identifier, wherein the supply identifier is used to characterize the data supplier information of the original data; performing text recognition on the original data to obtain the identification confidentiality level of the original data.

[0008] Preferably, the text recognition is performed on the original data to obtain the identification level of the original data, which specifically includes: matching the keywords of the original data based on a preset keyword list; using the keywords of the original data as the word segmentation nodes of the original data to divide the original data into several data segments; extracting the keywords of several data segments respectively to obtain keyword information, and determining the identification level of the original data based on the mapping relationship between the keyword information and the preset level.

[0009] Preferably, after obtaining the original data of the data supplier, the set confidentiality level and the identification confidentiality level of the original data, the data storage method also includes: calculating the warning score of the set confidentiality level based on the set confidentiality level and the identification confidentiality level; judging whether the warning score of the set confidentiality level is less than the warning threshold; in response to the warning score of the set confidentiality level being less than the warning threshold, sending warning information to the data supplier, and encrypting the original data to obtain ciphertext data specifically includes: calculating the comprehensive attribute weight of the original data based on the entropy calculation method, wherein the original data includes data of at least one attribute, and the comprehensive attribute weight is used to characterize the importance of the data of each attribute relative to the original data; clustering and cleaning the original data based on the comprehensive attribute weight and the clustering algorithm; encrypting the cleaned original data to obtain ciphertext data.

[0010] Preferably, the step of calculating the warning score of the set confidentiality level based on the set confidentiality level and the identified confidentiality level specifically includes: calculating the warning score of the set confidentiality level according to the following formula:

[0011] Among them, Score i represents the early warning score, M i Indicates the identification level, M′ i Indicates the set security level, M max Indicates the maximum confidentiality level, M min Indicates the minimum confidentiality level.

[0012] Preferably, the path information of the ciphertext data extracted specifically includes: extracting the supply identifier of the original data, the unique identifier of the ciphertext data and the size of the ciphertext data; generating a hash address of the ciphertext data based on the secure hash SHA256 algorithm, wherein the hash address is used to characterize the storage area where the ciphertext data is stored in the data lake; based on the supply identifier, the unique identifier, the size of the ciphertext data and the hash address, forming the path information of the ciphertext data.

[0013] Preferably, the segmented encryption of the path information based on the set confidentiality level and the identified confidentiality level to obtain the path ciphertext specifically includes: determining a corresponding range of confidentiality levels according to the set confidentiality level and the identified confidentiality level, wherein the corresponding range of confidentiality levels is used to characterize the confidentiality level range required by the data demander for obtaining the path information; segmenting the path information into supply identifier information, unique identifier information, ciphertext data size information and hash address information; determining the confidentiality levels of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels; encrypting the supply identifier information, unique identifier information, ciphertext data size information and hash address information based on the confidentiality levels of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, and splicing them into path ciphertext.

[0014] Preferably, the method of determining the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels specifically includes: evaluating the importance of the supply identifier information, unique identifier information, ciphertext data size information and hash address information; sorting the importance of the supply identifier information, unique identifier information, ciphertext data size information and hash address information; determining the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels and the sorting result.

[0015] Preferably, the encryption of the supply identifier information, unique identifier information, ciphertext data size information and hash address information based on the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information specifically includes: determining the encryption measures for the supply identifier information, unique identifier information, ciphertext data size information and hash address information based on the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, and the mapping relationship between the confidentiality level and preset encryption measures; and encrypting the supply identifier information, unique identifier information, ciphertext data size information and hash address information based on the encryption measures for the supply identifier information, unique identifier information, ciphertext data size information and hash address information, respectively.

[0016] Preferably, the generation of a blockchain connected to a data demander based on the path ciphertext specifically includes: generating a placement block based on the path ciphertext, and numbering the placement block to obtain a block number; associating the corresponding range of the confidentiality level, the block number and the keyword information to obtain an index information list; generating an index block based on the index information list, and splicing the index block and the placement block to form a blockchain connected to the data demander.

[0017] In the second aspect, the present invention also provides a data storage device, including an acquisition module, a first encryption module, a second encryption module and a generation module, the acquisition module is used to obtain the original data of the data supplier, set the confidentiality level and identify the confidentiality level, the first encryption module is connected to the acquisition module, and is used to encrypt the original data to obtain ciphertext data, and store the original data and the ciphertext data in different storage areas of the data lake respectively, the second encryption module is connected to the first encryption module, and is used to extract the path information of the ciphertext data, and based on the set ciphertext and the identified ciphertext, the path information is segmented and encrypts the path information to obtain the path ciphertext, and the generation module is connected to the second encryption module, and is used to generate a blockchain connected to the data demander based on the path ciphertext.

[0018] In a third aspect, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the data storage method provided in the first aspect.

[0019] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the data storage method provided in the first aspect is implemented.

[0020] The present invention provides a data storage method, device, electronic device and computer-readable storage medium. The method encrypts the original data of the data supplier to obtain ciphertext data, thereby providing a first-level guarantee for the security and privacy of the original data storage. The original data and ciphertext data are partitioned and stored in a data lake, and the ability of the data lake to centrally store massive, multi-source and multi-type original data is utilized to effectively alleviate the storage and management pressure brought by massive and repeated data. The text recognizes the identification level of the original data, extracts the path information containing the ciphertext data in the data lake storage location, and then combines the identification level and the set level of the original data to assign different levels of confidentiality to different contents in the path information. The path information is encrypted by taking encryption measures corresponding to different confidentiality levels to obtain the path ciphertext, so that only the corresponding part of the content that meets the confidentiality level is displayed to the data demander who does not meet all the confidentiality requirements of the path information, reducing the possibility of the ciphertext data being stolen or tampered with, and providing a second layer of protection for the security and privacy of the original data storage; based on the path ciphertext, a blockchain that is connected to the data demander is generated, and the encryption attribute of the blockchain technology itself is used to provide a third layer of protection for the security and privacy of the original data storage. Compared with directly storing the original data based on the blockchain technology, the storage pressure of the blockchain technology and the calculation pressure of subsequent data query and management are greatly alleviated, and the efficiency of data query and management is improved. Therefore, the present invention can realize intelligent and secure data storage, effectively alleviate the pressure of massive and repeated data storage, and effectively improve the efficiency and data security of data storage and data management. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a flow chart of a data storage method according to Embodiment 1 of the present invention;

[0022] Figure 2 This is a flow chart of a data storage method according to Embodiment 2 of the present invention;

[0023] Figure 3 This is a schematic diagram of the structure of a data storage device according to Embodiment 3 of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of a data storage device according to embodiment 4 of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0026] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0027] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0028] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0029] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0030] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0031] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0032] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0033] Embodiment 1:

[0034] like Figure 1 As shown, this embodiment provides a data storage method. The data storage method includes:

[0035] S101, obtaining the original data of the data supplier, the set confidentiality level of the original data, and the identification confidentiality level.

[0036] In this embodiment, due to the massive storage characteristics of the data lake, a data lake connected to data suppliers is constructed to connect to a large number of data suppliers, and multi-directional raw data is obtained and stored from a large number of data suppliers. In addition, since the data lake also provides partition storage capabilities, after obtaining the raw data and subsequently encrypting the raw data to obtain ciphertext data, the raw data and ciphertext data can be stored in different storage areas to facilitate subsequent data management.

[0037] Specifically, S101: obtaining the original data of the data supplier, the set confidentiality level and the identified confidentiality level of the original data, including steps S1011 to S1013:

[0038] S1011, obtaining the original data from the data supplier and the set confidentiality level of the original data.

[0039] In this embodiment, while the data lake obtains the original data provided by the data supplier, it can also obtain the set confidentiality level set by the data supplier for the original data.

[0040] S1012: Identify the original data based on the supply identifier, where the supply identifier is used to represent the data supplier information of the original data.

[0041] In this embodiment, since there is a large-scale aggregation of original data from multiple parties and it is deeply coupled with the business, after obtaining the original data from the data supplier, this embodiment also tags the original data of the data supplier with the label of the data supplier, that is, the supply identifier.

[0042] S1013, performing text recognition on the original data to obtain the identification level of the original data.

[0043] Specifically, S1013: performing text recognition on the original data to obtain the identification level of the original data, including: matching the keywords of the original data based on a preset keyword list; using the keywords of the original data as the word segmentation nodes of the original data to divide the original data into several data segments; extracting the keywords of several data segments respectively to obtain keyword information, and determining the identification level of the original data based on the mapping relationship between the keyword information and the preset level.

[0044] In this embodiment, the original data includes text, reports, and emails. The keyword list can be formed by integrating manual experience input and utilizing the original data stored in the data lake to conduct data mining and analysis, thereby identifying high-frequency words, subject words, and related keywords. The keyword list includes several keywords, which are usually preset sensitive words and confidential words, such as amount, time, and personnel.

[0045] The original data is matched with each keyword in the keyword list. If there is a phrase identical to the keyword in the original data, the phrase identical to the keyword is determined as a segmentation node. The original data is segmented based on the segmentation node to obtain several data segments. Each data segment can be a complete sentence or a phrase containing a keyword. The keywords corresponding to each data segment (i.e., segmentation node) are summarized to obtain keyword information for subsequent use as index information of the blockchain; according to the mapping relationship between the keyword information and the preset confidentiality level, the identification confidentiality level of the original data can be determined, such as: the confidentiality level of the data segment with the amount as the segmentation node is higher than that of the data segment with the time as the segmentation node, and then the identification confidentiality level of the original data is determined by comprehensive judgment of the confidentiality levels of different data segments. In this embodiment, the remaining content in the original data is segmented by using the segmentation node as the boundary, and then the original data is segmented into several data segments. It can also be segmented by a secondary segmentation method. Under the premise of ensuring the segmentation with keywords, there is no need to expand the keyword list, and the content not in the keyword list can be segmented, and the situation where the data supplier hides the content in the original data can be avoided.

[0046] It should be noted that, before matching the keywords of the original data based on the preset keyword list, this embodiment can first use natural language processing (NLP) technology to segment the original data, for example, using a segmentation algorithm (such as Jieba segmentation) to segment the original data, so as to facilitate the subsequent comparison of the segmented original data with the preset keyword list, find the matching keywords in the original data, and identify each segmentation node in the original data. This embodiment can achieve keyword matching of the original data through simple string matching or more complex machine learning algorithms, such as fuzzy matching algorithms.

[0047] Usually, the mapping relationship between keyword information and preset confidentiality levels is determined based on the data confidentiality standards of data suppliers and data demanders. First, the keywords need to be mapped to the corresponding confidentiality levels. For example, keywords such as "user data", "financial report", and "project plan" are mapped to public (no sensitive information), internal (sensitive information but does not affect the overall), confidential (involving confidential information), and top secret (seriously involving confidential information).

[0048] Since the identification level is usually higher than the set level, after the cleaned raw data is subsequently encrypted to form ciphertext data, this embodiment also associates the identification level with the ciphertext data as a standard for obtaining the ciphertext data. By associating the identification level with the ciphertext data, this embodiment can verify whether the subsequent data demander meets the standard for obtaining the ciphertext data.

[0049] Optionally, after S101: acquiring the original data, the set confidentiality level and the identified confidentiality level of the original data from the data supplier, the data storage method further includes:

[0050] S105, calculating a warning score of the set confidentiality level based on the set confidentiality level and the identified confidentiality level.

[0051] Specifically, S105: calculating the warning score of the set confidentiality level based on the set confidentiality level and the identified confidentiality level, including: calculating the warning score of the set confidentiality level according to the following formula:

[0052] Among them, Score i represents the early warning score, M i Indicates the identification level, M′ i Indicates the set security level, M max Indicates the maximum confidentiality level, M min Indicates the minimum confidentiality level.

[0053] S106, determining whether the warning score of the set confidentiality level is less than the warning threshold.

[0054] S107: In response to the warning score of the set confidentiality level being less than the warning threshold, sending a warning message to the data supplier.

[0055] In this embodiment, the warning threshold is 0.75, and it is determined whether the warning score of the set confidentiality level is less than 0.75. If it is less than 0.75, a warning message is sent to the data supplier to prompt the data supplier to re-evaluate the rationality of the set confidentiality level. This embodiment evaluates the rationality of the set confidentiality level by calculating the gap between the identified confidentiality level and the set confidentiality level. If the set confidentiality level is unreasonable, a data security warning is issued when the data supplier provides the original data, and the set confidentiality level is re-planned to avoid data security risks caused by unreasonable set confidentiality levels, thereby improving the security and privacy of original data storage and management.

[0056] S102: Encrypt the original data to obtain ciphertext data, and store the original data and the ciphertext data in different storage areas of the data lake respectively.

[0057] Specifically, encrypting the original data to obtain ciphertext data includes steps S1021 to S1023:

[0058] S1021, calculating the comprehensive attribute weight of the original data based on the entropy calculation method, wherein the original data includes data of at least one attribute, and the comprehensive attribute weight is used to characterize the importance of the data of each attribute relative to the original data.

[0059] In this embodiment, the attributes of each data in the original data of the current data supplier are defined as the reference attributes of the original data of the current data supplier, and the original data of other data suppliers with the same reference attributes in the data lake are extracted. Combined with the reference attribute weights of the original data of other data suppliers, the comprehensive attribute weight of the original data of the current data supplier is calculated through the entropy calculation method.

[0060] It should be noted that, considering that there are many data suppliers in the original data, the original data usually contains missing data, similar duplicate data, and abnormal data. Therefore, after obtaining the original data including the set confidentiality level, and before clustering and cleaning the original data based on the comprehensive attribute weight and clustering algorithm, it also includes: data cleaning of the original data. Data cleaning of the original data specifically includes: preprocessing the original data, where the preprocessing includes missing value processing and denoising.

[0061] The missing value processing of the original data specifically includes: calculating the missing ratio of each variable in the original data; judging whether the missing ratio of each variable is greater than the missing threshold; in response to the missing ratio of the target variable being greater than the missing threshold, deleting the target variable; in response to the missing ratio of the target variable being less than the missing threshold, obtaining the type of the target variable; judging whether the type is continuous; in response to the type being continuous, filling the target variable by the mean method; in response to the type being discrete, filling the target variable by the median method.

[0062] The original data is subjected to denoising, specifically comprising: performing binning operation on the original data to obtain a number of data bins; obtaining the median value of the original data in the several data bins, and using the median value as the original data in the data bins.

[0063] The properties of raw data usually include the following categories: 1. Data type: numeric type (integer, floating point number), string type (text data), Boolean type (true / false value), time type (date, timestamp); 2. Data structure: structured data (such as tabular form), semi-structured data (such as JSON, XML), unstructured data (such as text files, images, audio); 3. Data source: sensor data (such as data collected by IoT devices), user-generated data (such as social media posts, comments), system logs (such as logs generated by servers or applications); 4. Metadata: descriptive information of the data (such as data creation time, author, data source), data format, unit and range; 5. Data quality indicators: completeness (whether there are missing values), accuracy (whether the data reflects the real situation), consistency (whether the data is consistent in different systems), timeliness (frequency and timeliness of data updates); 6. Data volume: the scale of the data (number of rows, file size), data correlation: the relationship between the data and other data sets (for example, foreign key relationships, dependencies).

[0064] S1022, clustering and cleaning the raw data based on comprehensive attribute weights and clustering algorithms.

[0065] In this embodiment, based on the clustering algorithm, each data in the original data of the current data supplier is clustered to divide the original data into multiple sets of original data with similar reference attributes, and the comprehensive attribute weight is compared with the reference attribute weight of multiple sets of original data with similar reference attributes to complete the clustering and cleaning of all data in the original data of the current data supplier, specifically: the Euclidean distance between the reference attribute weight and the comprehensive attribute weight of multiple sets of original data with similar reference attributes is calculated, and it is determined whether the Euclidean distance is greater than the distance threshold. If the Euclidean distance is less than the distance threshold, the data with similar reference attributes in the original data is retained. This embodiment calculates the comprehensive attribute weight of the original data of the current data supplier by comprehensively considering the reference attribute weight of the original data of other data suppliers with the same reference attributes in the data lake, thereby improving the reliability of the comprehensive attribute weight; by cleaning the original data through the clustering algorithm, each data in the original data can be divided into multiple sets of original data with similar reference attributes, and then the comprehensive attribute weight is matched with the reference attribute weight of multiple sets of original data with similar reference attributes, which can reduce the number of matches and reduce the risk of data omission.

[0066] S1023, encrypt the cleaned original data to obtain ciphertext data.

[0067] In this embodiment, according to the formula M=Encrypt(YS,SY), the cleaned original data is encrypted to obtain ciphertext data, where M represents ciphertext data, Encrypt(·) represents encryption processing, YS represents the cleaned original data, and SY represents a private key. After the data demander obtains the ciphertext data, the ciphertext data can be decrypted by the public key. In this embodiment, the original data is encrypted by a key to form ciphertext data, ensuring that the original data cannot be directly interpreted by the outside; the storage area of ​​the original data is verified by public key decryption to prevent the problem of impersonation.

[0068] S103, extracting the path information of the ciphertext data, and encrypting the path information in sections based on the set confidentiality level and the identified confidentiality level to obtain the path ciphertext.

[0069] In this embodiment, the path information is used to guide the data demander to the storage area of ​​the ciphertext data corresponding to the path information in the data lake, so as to help the data demander securely obtain the original data.

[0070] Specifically, extracting the path information of the ciphertext data includes steps S1031 to S1033:

[0071] S1031, extracting the supply identifier of the original data, the unique identifier of the ciphertext data, and the size of the ciphertext data.

[0072] In this embodiment, after the original data is encrypted to obtain the ciphertext data, the ciphertext data is also labeled, that is, a unique identifier, and the size of the ciphertext data is counted, wherein the unique identifier is used to point to the ciphertext data and is unique, and the ciphertext data size refers to the capacity of the ciphertext data.

[0073] S1032: Generate a hash address of the ciphertext data based on the secure hash SHA256 algorithm, where the hash address is used to represent the storage area where the ciphertext data is stored in the data lake.

[0074] In this embodiment, the hash address of the ciphertext data is calculated according to the formula HX=SHA256(M), where HX represents the hash address of the ciphertext data, SHA256(·) represents the SHA (Secure Hash Algorithm) 256 algorithm, and M represents the ciphertext data.

[0075] S1033, based on the supply identifier, the unique identifier, the ciphertext data size and the hash address, form the path information of the ciphertext data.

[0076] Specifically, based on the set confidentiality level and the identified confidentiality level, the path information is encrypted in segments to obtain the path ciphertext, including steps S1034 to S1037:

[0077] S1034, determining a corresponding range of confidentiality levels according to the set confidentiality levels and the identified confidentiality levels, wherein the corresponding range of confidentiality levels is used to characterize the confidentiality level range required by the data demander for obtaining the path information.

[0078] In this embodiment, the set confidentiality level and the identification confidentiality level of the original data are used as the corresponding range of confidentiality levels, that is, the critical value of the confidentiality level range required to obtain the path information. For example, if the set confidentiality level is smaller than the identification confidentiality level, the set confidentiality level is used as the minimum confidentiality level required to obtain the path information, and the identification confidentiality level is used as the maximum confidentiality level required to obtain the path information.

[0079] S1035, segment the path information into supply identifier information, unique identifier information, ciphertext data size information and hash address information.

[0080] In this embodiment, based on the composition of the path information, namely, the supply identifier, the unique identifier, the ciphertext data size and the hash address, the path information is split into several sub-path information, namely, the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information.

[0081] S1036, determine the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels.

[0082] Specifically, S1036: Determine the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels, including: evaluating the importance of the supply identifier information, unique identifier information, ciphertext data size information and hash address information; sorting the importance of the supply identifier information, unique identifier information, ciphertext data size information and hash address information; determine the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels and the sorting results.

[0083] In this embodiment, it is assumed that there are different confidentiality levels of 1-3, and the confidentiality level is set to level 1, and the identification confidentiality level is set to level 3. The supply identifier information and the ciphertext data size can be determined as the confidentiality level of level 1, the unique identifier information can be determined as the confidentiality level of level 2, and the hash address information can be determined as the confidentiality level of level 3. If the confidentiality level applied for decryption by the data demander is at level 2, the hash address information cannot be obtained. In this embodiment, by determining the corresponding range of confidentiality levels and corresponding to the segmented encryption of path information, when the data demander obtains path information, based on its own confidentiality level authority, it can consult part of the path information to a certain extent, thereby improving the security of the original data.

[0084] S1037, based on the confidentiality level of the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information, encrypt the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information, and concatenate them into a path ciphertext.

[0085] Specifically, based on the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, the supply identifier information, unique identifier information, ciphertext data size information and hash address information are encrypted, including: based on the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, and the mapping relationship between the confidentiality level and the preset encryption measure, the encryption measure of the supply identifier information, unique identifier information, ciphertext data size information and hash address information is determined; based on the encryption measure of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, the supply identifier information, unique identifier information, ciphertext data size information and hash address information are respectively encrypted.

[0086] In this embodiment, based on the confidentiality level of different sub-path information and the encryption measures corresponding to the confidentiality level, different sub-path information is encrypted in segments to form several sub-path ciphertexts. Several sub-path ciphertexts are spliced ​​to form path ciphertexts. In this embodiment, by splitting the path information into supply identifier information, unique identifier information, ciphertext data size information and hash address information, and encrypting them in segments, hierarchical encryption storage can be completed according to the importance of the information, and the risk of single-point attack (such as data leakage) can be avoided, so that even if the attacker obtains part of the information, the rest of the information is still safe, which increases the difficulty of data leakage and tampering.

[0087] It should be noted that the confidentiality level in this embodiment not only reflects the confidentiality level authority required by the data demander to obtain the path information, but also reflects the importance of different sub-path information, namely, the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information. The segmented encryption method can be encrypted using an asymmetric algorithm, and the encryption measures of different confidentiality levels can be reflected in the key length and the complexity of the encryption process.

[0088] S104, based on the path ciphertext, generate a blockchain that interfaces with the data demander.

[0089] Specifically, S104: Based on the path ciphertext, a blockchain connected to the data demander is generated, including steps S1041 to S1043:

[0090] S1041, generating a placement block based on the path ciphertext, and numbering the placement block to obtain a block number.

[0091] S1042, associate the corresponding range of confidentiality levels, block numbers and keyword information to obtain an index information list.

[0092] S1043, based on the index information list, generate index blocks, and splice the index blocks and placement blocks to form a blockchain that connects with the data demander.

[0093] In this embodiment, a number of blank blocks are constructed to interface with the data demander, and the path ciphertext is stored in the blank block to form a placement block, and a block number is identified for the placement block, and the block number is used to indicate the placement block corresponding to the storage of the path ciphertext. The placement block stores the path ciphertext that can be connected to the storage area, rather than the original data in the storage area itself, which can greatly reduce the storage capacity of the placement block.

[0094] This embodiment also stores an index information list in a blank block to form an index block, wherein the index information list is formed by associating the corresponding range of the confidentiality level, the block number, and the keyword information. After the index block is formed, the data demander can quickly obtain the path ciphertext corresponding to the required original data by performing data retrieval in the index block. The index block and the placement block eventually form a blockchain that is connected to the data demander. When the data demander needs to obtain the original data, it must make an acquisition request to the placement block, obtain the hash address after decrypting the path ciphertext, and then obtain the original data, rather than directly extracting the original data from the data lake. This embodiment stores the path ciphertext pointing to the storage area of ​​the ciphertext data in the placement block, and provides security for the original data through the encryption property of the blockchain technology itself; by storing only the path ciphertext corresponding to the path information in the placement block instead of directly storing the original data in the placement block, the pressure of data storage and data management of the blockchain is greatly alleviated; by constructing an index block and using the index block to directly search to the required placement block, and then completing the extraction of the original data, the retrieval difficulty caused by the linear search caused by the chain storage characteristics of the blockchain is reduced, and the retrieval efficiency is improved.

[0095] The present embodiment provides a data storage method, which encrypts the original data of the data supplier to obtain ciphertext data, thereby providing a first layer of protection for the security and privacy of the original data storage; partitions the original data and ciphertext data into a data lake, and uses the data lake's ability to centrally store massive, multi-source, and multi-type original data to effectively alleviate the storage and management pressures brought by massive and repeated data; text recognizes the identification level of the original data, extracts the path information containing the ciphertext data at the storage location of the data lake, and then combines the identification level and the set level of the original data to assign different levels of confidentiality to different contents in the path information, so as to adopt encryption measures corresponding to different levels of confidentiality to encrypt the path information to obtain path ciphertext, so as to deal with the path information that does not meet the requirements. Data demanders with all confidentiality requirements only display the corresponding content that meets the confidentiality level, reducing the possibility of ciphertext data being stolen or tampered with, and providing a second layer of protection for the security and privacy of original data storage; blockchains that are connected to data demanders based on path ciphertext generation use the encryption properties of blockchain technology itself to provide a third layer of protection for the security and privacy of original data storage. Compared with directly storing original data based on blockchain technology, it greatly alleviates the storage pressure of blockchain technology and the computing pressure of subsequent data query and management, improves the efficiency of data query and management, realizes intelligent and secure data storage, effectively alleviates the pressure of massive and repeated data storage, and effectively improves the efficiency and data security of data storage and data management. In addition, by using the word segmentation node as the boundary, the remaining content in the original data is segmented, and then the original data is divided into several data segments. It can also be split by secondary segmentation. Under the premise of ensuring that the keyword is used for segmentation, there is no need to expand the keyword list, and the content that is not in the keyword list can be segmented, and the situation where the data supplier hides the content in the original data can be avoided. By associating the identification level with the ciphertext data, it can be verified whether the subsequent data demander meets the standard for obtaining the ciphertext data. By calculating the gap between the identified confidentiality level and the set confidentiality level, the rationality of the set confidentiality level is evaluated. In the case of unreasonable set confidentiality level, a data security warning is issued when the data supplier provides the original data, and the confidentiality level is re-planned to avoid data security risks caused by unreasonable set confidentiality level, and the security and privacy of original data storage and management are improved. By comprehensively considering the attribute weights of the original data with reference attributes from other data suppliers, the reliability of the comprehensive attribute weights is improved; by cleaning the original data through the clustering algorithm, the pre-processed original data can be matched with different small data sets, which can reduce the number of matches and reduce the risk of data omissions. The original data is encrypted with a key to form ciphertext data to ensure that the original data cannot be directly interpreted by the outside world; the storage area of ​​the original data is verified to be correct through public key decryption to eliminate the problem of impersonation.By determining the corresponding range of confidentiality level and corresponding to the segmented encryption of path information, when the data demander obtains the path information, based on its own confidentiality level authority, it can consult part of the path information to a certain extent, thereby improving the security of the original data. By splitting the path information into supply identifier information, unique identifier information, ciphertext data size information and hash address information, and performing segmented encryption, hierarchical encryption storage can be completed according to the importance of the information, which can avoid the risk of single point attack (such as data leakage), so that even if the attacker obtains part of the information, the rest of the information is still safe, increasing the difficulty of data leakage and tampering. By storing the path ciphertext pointing to the storage area of ​​the ciphertext data in the placement block, the encryption property of the blockchain technology itself is used to provide protection for the security of the original data; by only storing the path ciphertext corresponding to the path information in the placement block, rather than directly storing the original data in the placement block, the pressure of data storage and data management of the blockchain is greatly alleviated; by constructing an index block and using the index block to directly retrieve the required placement block, the original data can be extracted, which reduces the difficulty of retrieval caused by linear search caused by the chain storage characteristics of the blockchain, and improves the retrieval efficiency.

[0096] Embodiment 2:

[0097] like Figure 2 As shown, this embodiment provides a data storage method, the data storage method includes:

[0098] S10, build a data lake connected to the data supplier, obtain the original data of the data supplier and set the confidentiality level, and allocate a storage area for the original data in the data lake.

[0099] In this embodiment, due to the massive storage characteristics of the data lake, a data lake connected to data suppliers is constructed to connect to a large number of data suppliers, and multi-directional raw data is obtained and stored from a large number of data suppliers. In addition, since the data lake also provides partition storage capabilities, after obtaining the raw data and subsequently encrypting the raw data to obtain ciphertext data, the raw data and ciphertext data can be stored in different storage areas to facilitate subsequent data management.

[0100] While obtaining the original data provided by the data supplier in the data lake, you can also obtain the set confidentiality level set by the data supplier for the original data.

[0101] Since there is a large-scale aggregation of original data from multiple parties and it is deeply coupled with the business, after acquiring the original data from the data supplier, this embodiment also tags the original data of the data supplier with the label of the data supplier, that is, the supply identifier.

[0102] S20, performing text recognition on the original data to obtain the identification level of the original data; encrypting the original data to obtain ciphertext data; and associating the identification level with the ciphertext data.

[0103] In this embodiment, the original data includes text, reports, and emails. The keyword list can be formed by integrating manual experience input and utilizing the original data stored in the data lake to conduct data mining and analysis, thereby identifying high-frequency words, subject words, and related keywords. The keyword list includes several keywords, which are usually preset sensitive words and confidential words, such as amount, time, and personnel.

[0104] Match the original data with each keyword in the keyword list. If there is a phrase identical to the keyword in the original data, the phrase identical to the keyword is determined as a segmentation node. The original data is segmented based on the segmentation node to obtain several data segments. Each data segment can be a complete sentence or a phrase containing a keyword. The keywords corresponding to each data segment (i.e., segmentation node) are summarized to obtain keyword information for subsequent use as index information of the blockchain; according to the mapping relationship between the keyword information and the preset confidentiality level, the identification confidentiality level of the original data can be determined, such as: the confidentiality level of the data segment with the amount as the segmentation node is higher than that of the data segment with the time as the segmentation node, and then the identification confidentiality level of the original data is determined by comprehensive judgment of the confidentiality levels of different data segments. The attributes of each data in the original data of the current data supplier are defined as the reference attributes of the original data of the current data supplier, and the original data of other data suppliers with the same reference attributes in the data lake are extracted. Combined with the reference attribute weights of the original data of other data suppliers, the comprehensive attribute weight of the original data of the current data supplier is calculated by the entropy value calculation method.

[0105] Based on the clustering algorithm, each data in the original data of the current data supplier is clustered to divide the original data into multiple original data sets with similar reference attributes, and the comprehensive attribute weight is compared with the reference attribute weight of multiple original data sets with similar reference attributes to complete the clustering and cleaning of all data in the original data of the current data supplier. Specifically, the Euclidean distance between the reference attribute weight and the comprehensive attribute weight of multiple original data sets with similar reference attributes is calculated, and it is determined whether the Euclidean distance is greater than the distance threshold. If the Euclidean distance is less than the distance threshold, the data with similar reference attributes in the original data is retained.

[0106] According to the formula M=Encrypt(YS,SY), the cleaned original data is encrypted to obtain the ciphertext data, where M represents the ciphertext data, Encrypt(·) represents the encryption process, YS represents the cleaned original data, and SY represents the private key. After the data demander obtains the ciphertext data, the ciphertext data can be decrypted using the public key.

[0107] S30, extracting the path information of the ciphertext data, and encrypting the path information to obtain the path ciphertext.

[0108] In this embodiment, the path information is used to guide the data demander to the storage area of ​​the ciphertext data corresponding to the path information in the data lake, so as to help the data demander securely obtain the original data.

[0109] After encrypting the original data to obtain the ciphertext data, the ciphertext data is also labeled, that is, a unique identifier, and the size of the ciphertext data is counted. The unique identifier is used to point to the ciphertext data and is unique. The ciphertext data size refers to the capacity of the ciphertext data.

[0110] The hash address of the ciphertext data is calculated according to the formula HX=SHA256(M), where HX represents the hash address of the ciphertext data, SHA256(·) represents the SHA (Secure Hash Algorithm) 256 algorithm, and M represents the ciphertext data.

[0111] The set confidentiality level and identification confidentiality level of the original data are used as the corresponding range of confidentiality levels, that is, the critical value of the confidentiality level range required to obtain the path information. For example, if the set confidentiality level is smaller than the identification confidentiality level, the set confidentiality level is used as the minimum confidentiality level required to obtain the path information, and the identification confidentiality level is used as the maximum confidentiality level required to obtain the path information.

[0112] Based on the composition of the path information, namely, the supply identifier, the unique identifier, the ciphertext data size and the hash address, the path information is split into several sub-path information, namely, the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information.

[0113] Assuming that there are different levels of confidentiality from 1 to 3, the confidentiality level is set to level 1 and the identification level to level 3. The supply identifier information and the ciphertext data size can be determined as level 1, the unique identifier information can be determined as level 2, and the hash address information can be determined as level 3. If the data demander applies for decryption at level 2, the hash address information cannot be obtained.

[0114] Based on the confidentiality levels of different sub-path information and the encryption measures corresponding to the confidentiality levels, different sub-path information is encrypted in sections to form several sub-path ciphertexts. Several sub-path ciphertexts are concatenated to form a path ciphertext.

[0115] S40, constructing a number of blank blocks connected to the data demander, storing the path ciphertext in the blank blocks to form a placement block, and marking a block number for the placement block.

[0116] In this embodiment, a number of blank blocks are constructed to interface with the data demander, and the path ciphertext is stored in the blank block to form a placement block, and a block number is identified for the placement block, and the block number is used to indicate the placement block corresponding to the storage of the path ciphertext. The placement block stores the path ciphertext that can be connected to the storage area, rather than the original data in the storage area itself, which can greatly reduce the storage capacity of the placement block.

[0117] S50, storing the index information list in the blank block to form an index block; splicing the placement block and the index block to form a blockchain connected to the data demander.

[0118] In this embodiment, an index information list is stored in a blank block to form an index block, wherein the index information list is formed by associating the corresponding range of the confidentiality level, the block number, and the keyword information. After the index block is formed, the data demander can quickly obtain the path ciphertext corresponding to the required original data by performing data retrieval in the index block. The index block and the placement block eventually form a blockchain that is connected to the data demander. When the data demander needs to obtain the original data, it must make an acquisition request to the placement block, obtain the hash address after decrypting the path ciphertext, and then obtain the original data, rather than directly extracting the original data from the data lake.

[0119] The present embodiment provides a data storage method, which encrypts the original data of the data supplier to obtain ciphertext data, thereby providing a first layer of protection for the security and privacy of the original data storage; partitions the original data and ciphertext data into a data lake, and uses the data lake's ability to centrally store massive, multi-source, and multi-type original data to effectively alleviate the storage and management pressures brought by massive and repeated data; text recognizes the identification level of the original data, extracts the path information containing the ciphertext data at the storage location of the data lake, and then combines the identification level and the set level of the original data to assign different levels of confidentiality to different contents in the path information, so as to adopt encryption measures corresponding to different levels of confidentiality to encrypt the path information to obtain path ciphertext, so as to deal with the path information that does not meet the requirements. Data demanders with all confidentiality requirements only display the content corresponding to the confidentiality level, reducing the possibility of theft or tampering of ciphertext data, and providing a second layer of protection for the security and privacy of original data storage; the blockchain that connects with data demanders based on path ciphertext generation uses the encryption properties of blockchain technology itself to provide a third layer of protection for the security and privacy of original data storage. Compared with directly storing original data based on blockchain technology, it greatly alleviates the storage pressure of blockchain technology and the computing pressure of subsequent data query and management, improves the efficiency of data query and management, realizes intelligent and secure data storage, effectively alleviates the pressure of massive and duplicate data storage, and effectively improves the efficiency and data security of data storage and data management.

[0120] Embodiment 3:

[0121] like Figure 3 As shown, this embodiment also provides a data storage device, including:

[0122] The input module 10 is used to build a data lake connected to the data supplier, obtain the original data of the data supplier and set the confidentiality level, and allocate a storage area for the original data in the data lake.

[0123] The first processing module 20 is used to perform text recognition on the original data to obtain the identification level of the original data; encrypt the original data to obtain ciphertext data; and associate the identification level with the ciphertext data.

[0124] The second processing module 30 is used to extract the path information of the ciphertext data and encrypt the path information to obtain the path ciphertext.

[0125] The storage module 40 is used to construct a number of blank blocks connected to the data demander, store the path ciphertext in the blank blocks to form a placement block, and mark the placement block with a block number.

[0126] The association module 50 is used to store the index information list in the blank block to form an index block; and to splice the placement block and the index block to form a blockchain connected to the data demander.

[0127] The present embodiment provides a data storage method, which encrypts the original data of the data supplier to obtain ciphertext data, thereby providing a first layer of protection for the security and privacy of the original data storage; partitions the original data and ciphertext data into a data lake, and uses the data lake's ability to centrally store massive, multi-source, and multi-type original data to effectively alleviate the storage and management pressures brought by massive and repeated data; text recognizes the identification level of the original data, extracts the path information containing the ciphertext data at the storage location of the data lake, and then combines the identification level and the set level of the original data to assign different levels of confidentiality to different contents in the path information, so as to adopt encryption measures corresponding to different levels of confidentiality to encrypt the path information to obtain path ciphertext, so as to deal with the path information that does not meet the requirements. Data demanders with all confidentiality requirements only display the content corresponding to the confidentiality level, reducing the possibility of theft or tampering of ciphertext data, and providing a second layer of protection for the security and privacy of original data storage; the blockchain that connects with data demanders based on path ciphertext generation uses the encryption properties of blockchain technology itself to provide a third layer of protection for the security and privacy of original data storage. Compared with directly storing original data based on blockchain technology, it greatly alleviates the storage pressure of blockchain technology and the computing pressure of subsequent data query and management, improves the efficiency of data query and management, realizes intelligent and secure data storage, effectively alleviates the pressure of massive and duplicate data storage, and effectively improves the efficiency and data security of data storage and data management.

[0128] Embodiment 4:

[0129] like Figure 4 As shown, the present embodiment further provides a data storage device, including an acquisition module 41, a first encryption module 42, a second encryption module 43 and a generation module 44, the acquisition module 41 is used to acquire the original data of the data supplier, set the confidentiality level and identify the confidentiality level, the first encryption module 42 is connected to the acquisition module 41, and is used to encrypt the original data to obtain ciphertext data, and store the original data and the ciphertext data in different storage areas of the data lake respectively, the second encryption module 43 is connected to the first encryption module 42, and is used to extract the path information of the ciphertext data, and based on the set ciphertext and the identified ciphertext, the path information is segmented and encrypted to obtain the path ciphertext, and the generation module 44 is connected to the second encryption module 43, and is used to generate a blockchain connected to the data demander based on the path ciphertext.

[0130] Specifically, the acquisition module 41 includes: an acquisition unit 411, an identification unit 412 and a text recognition unit 413. The acquisition unit 411 is used to acquire the original data of the data supplier and the set confidentiality level of the original data. The identification unit 412 is used to identify the original data based on the supply identifier, wherein the supply identifier is used to characterize the data supplier information of the original data. The text recognition unit 413 is used to perform text recognition on the original data to obtain the identification confidentiality level of the original data.

[0131] Specifically, the text recognition unit 413 includes: a matching subunit, a segmentation subunit and an extraction subunit. The matching subunit is used to match the keywords of the original data based on a preset keyword list. The segmentation subunit is used to divide the original data into several data segments using the keywords of the original data as the segmentation nodes of the original data. The extraction subunit is used to extract the keywords of several data segments respectively to obtain keyword information, and determine the recognition level of the original data based on the mapping relationship between the keyword information and the preset level of confidentiality.

[0132] Optionally, the data storage device also includes: a calculation module 45, a judgment module 46 and a sending module 47, the calculation module 45 is used to calculate the warning score of the set confidentiality level based on the set confidentiality level and the identified confidentiality level, the judgment module 46 is used to judge whether the warning score of the set confidentiality level is less than the warning threshold, and the sending module 47 is used to send warning information to the data supplier in response to the warning score of the set confidentiality level being less than the warning threshold.

[0133] Specifically, the calculation module 45 includes: a first calculation unit 451, which is used to calculate the warning score of the set confidentiality level according to the following formula:

[0134] Among them, Score i represents the early warning score, M i Indicates the identification level, M′ i Indicates the set security level, M max Indicates the maximum confidentiality level, M min Indicates the minimum confidentiality level.

[0135] Specifically, the first encryption module 42 includes: a second calculation unit 421, a clustering unit 422 and a first encryption unit 423, the second calculation unit 421 is used to calculate the comprehensive attribute weight of the original data based on the entropy calculation method, wherein the original data includes data of at least one attribute, and the comprehensive attribute weight is used to characterize the importance of the data of each attribute relative to the original data, the clustering unit 422 is used to cluster and clean the original data based on the comprehensive attribute weight and the clustering algorithm, and the first encryption unit 423 is used to encrypt the cleaned original data to obtain ciphertext data.

[0136] Specifically, the second encryption module 43 includes: an extraction unit 431, a first generation unit 432 and a second generation unit 433. The extraction unit 431 is used to extract the supply identifier of the original data, the unique identifier of the ciphertext data and the size of the ciphertext data. The first generation unit 432 is used to generate a hash address of the ciphertext data based on the secure hash SHA 256 algorithm, wherein the hash address is used to characterize the storage area where the ciphertext data is stored in the data lake. The second generation unit 433 is used to form path information of the ciphertext data based on the supply identifier, the unique identifier, the size of the ciphertext data and the hash address.

[0137] Optionally, the second encryption module 43 also includes: a first determination unit 434, a segmentation unit 435, a second determination unit 436 and a second encryption unit 437, the first determination unit 434 is used to determine the corresponding range of confidentiality levels according to the set confidentiality level and the identified confidentiality level, wherein the corresponding range of confidentiality levels is used to characterize the confidentiality level range required by the data demander who obtains the path information, the segmentation unit 435 is used to segment the path information into supply identifier information, unique identifier information, ciphertext data size information and hash address information, the second determination unit 436 is used to determine the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of confidentiality levels, and the second encryption unit 437 is used to encrypt the supply identifier information, unique identifier information, ciphertext data size information and hash address information based on the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, and splice them into path ciphertext.

[0138] Specifically, the second determination unit 436 includes: an evaluation subunit, a sorting subunit and a first determination subunit, the evaluation subunit is used to evaluate the importance of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, the sorting subunit is used to sort the importance of the supply identifier information, unique identifier information, ciphertext data size information and hash address information, and the determination subunit is used to determine the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information according to the corresponding range of the confidentiality level and the sorting result.

[0139] Specifically, the second encryption unit 437 includes: a second determination subunit and an encryption subunit, the second determination subunit is used to determine the encryption measures for the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information based on the confidentiality level of the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information, and the mapping relationship between the confidentiality level and the preset encryption measures, the encryption subunit is used to encrypt the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information respectively based on the encryption measures for the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information.

[0140] Specifically, the generation module 44 includes: a third generation unit 441, an association unit 442 and a fourth generation unit 443. The third generation unit 441 is used to generate a placement block based on the path ciphertext, and number the placement block to obtain a block number. The association unit 442 is used to associate the corresponding range of the confidentiality level, the block number and the keyword information to obtain an index information list. The fourth generation unit 443 is used to generate an index block based on the index information list, and splice the index block and the placement block to form a blockchain connected to the data demander.

[0141] It can be understood that the data storage device provided above executes the data storage method corresponding to the embodiment 1 provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the scheme corresponding to the data storage method of the embodiment 1 above, and will not be repeated here.

[0142] Embodiment 5:

[0143] This embodiment further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the data storage method in the above-mentioned embodiments 1 and 2.

[0144] Embodiment 6:

[0145] This embodiment further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the data storage method in the above-mentioned embodiment 1 and embodiment 2 is implemented.

[0146] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A data storage method, characterized in that: include: Obtain the original data of the data supplier, the set confidentiality level of the original data and the identification confidentiality level; Encrypt the original data to obtain ciphertext data, and store the original data and ciphertext data in different storage areas of the data lake respectively; Extracting the path information of the ciphertext data, and encrypting the path information in sections based on the set confidentiality level and the identified confidentiality level to obtain the path ciphertext; Based on the path ciphertext, a blockchain is generated to connect with the data demander.

2. The data storage method according to claim 1, characterized in that: The obtaining of the original data of the data supplier, the setting of the confidentiality level of the original data and the identification of the confidentiality level specifically include: Obtain the original data from the data supplier and the set confidentiality level of the original data; Identify the original data based on the supply identifier, wherein the supply identifier is used to represent the data supplier information of the original data; Perform text recognition on the original data to obtain the identification level of the original data.

3. The data storage method according to claim 2, characterized in that: The text recognition of the original data to obtain the identification level of the original data specifically includes: Based on the preset keyword list, match the keywords of the original data; The keywords of the original data are used as the segmentation nodes of the original data to divide the original data into several data segments; Keywords of several data segments are extracted respectively to obtain keyword information, and based on the mapping relationship between the keyword information and the preset confidentiality level, the identification confidentiality level of the original data is determined.

4. The data storage method according to claim 1, characterized in that: After obtaining the original data of the data supplier, setting the confidentiality level of the original data and identifying the confidentiality level, the method further includes: Based on the set classification level and the identified classification level, calculate the warning score of the set classification level; Determine whether the warning score of the set confidentiality level is less than the warning threshold; In response to the warning score of the set confidentiality level being less than the warning threshold, a warning message is sent to the data supplier. The encrypting of the original data to obtain the ciphertext data specifically includes: Based on the entropy calculation method, the comprehensive attribute weight of the original data is calculated, wherein the original data includes data of at least one attribute, and the comprehensive attribute weight is used to characterize the importance of the data of each attribute relative to the original data; Cluster and clean the raw data based on comprehensive attribute weights and clustering algorithms; Encrypt the cleaned original data to obtain ciphertext data.

5. The data storage method according to claim 4, characterized in that: The calculation of the warning score of the set confidentiality level based on the set confidentiality level and the identified confidentiality level specifically includes: The warning score of the set confidentiality level is calculated according to the following formula: Among them, Score i represents the early warning score, M i Indicates the identification level, M′ i Indicates the set security level, M max Indicates the maximum confidentiality level, M min Indicates the minimum confidentiality level.

6. The data storage method according to claim 3, characterized in that: The path information for extracting the ciphertext data specifically includes: extracting a supply identifier of the original data, a unique identifier of the ciphertext data, and a size of the ciphertext data; Generate a hash address for the ciphertext data based on the secure hash SHA256 algorithm. The hash address is used to represent the storage area where the ciphertext data is stored in the data lake. Based on the supply identifier, the unique identifier, the ciphertext data size, and the hash address, path information of the ciphertext data is formed.

7. The data storage method according to claim 6, characterized in that: The step of encrypting the path information in sections based on the set confidentiality level and the identified confidentiality level to obtain the path ciphertext specifically includes: Determine a corresponding range of confidentiality levels according to the set confidentiality level and the identified confidentiality level, wherein the corresponding range of confidentiality levels is used to characterize the confidentiality level range required by the data demander for obtaining the path information; segmenting the path information into supply identifier information, unique identifier information, ciphertext data size information, and hash address information; Determine the confidentiality level of the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information according to the corresponding scope of the confidentiality level; Based on the confidentiality level of the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information, the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information are encrypted and concatenated into a path ciphertext.

8. The data storage method according to claim 7, characterized in that: Determining the confidentiality level of the supply identifier information, the unique identifier information, the ciphertext data size information, and the hash address information according to the corresponding range of the confidentiality level specifically includes: Assess the importance of the supply identifier information, unique identifier information, ciphertext data size information, and hash address information; sorting the importance of the supply identifier information, the unique identifier information, the ciphertext data size information, and the hash address information; Determine the confidentiality level of the supply identifier information, unique identifier information, ciphertext data size information and hash address information based on the corresponding range of confidentiality levels and the sorting results.

9. The data storage method according to claim 7, characterized in that: The encryption of the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information based on the confidentiality level of the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information specifically includes: Determine the encryption measures for the supply identifier information, the unique identifier information, the ciphertext data size information, and the hash address information based on the confidentiality levels of the supply identifier information, the unique identifier information, the ciphertext data size information, and the hash address information, and the mapping relationship between the confidentiality levels and the preset encryption measures; Based on the encryption measures for the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information, the supply identifier information, the unique identifier information, the ciphertext data size information and the hash address information are encrypted respectively.

10. The data storage method according to claim 7, characterized in that: The generation of a blockchain connected to a data demander based on the path ciphertext specifically includes: Generate a placement block based on the path ciphertext, and number the placement block to obtain a block number; Correlate the corresponding range of confidentiality levels, block numbers and keyword information to obtain an index information list; Based on the index information list, index blocks are generated, and index blocks and placement blocks are spliced ​​to form a blockchain that connects with data demanders.

11. A data storage device, characterized in that: It includes an acquisition module, a first encryption module, a second encryption module and a generation module, The acquisition module is used to obtain the original data of the data supplier, set the confidentiality level and identify the confidentiality level. The first encryption module is connected to the acquisition module and is used to encrypt the original data to obtain the ciphertext data, and store the original data and the ciphertext data in different storage areas of the data lake respectively. The second encryption module is connected to the first encryption module and is used to extract the path information of the ciphertext data, and based on the set ciphertext and the identification ciphertext, encrypt the path information in segments to obtain the path ciphertext. The generation module is connected to the second encryption module and is used to generate a blockchain connected to the data demander based on the path ciphertext.

12. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement a data storage method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, a data storage method according to any one of claims 1 to 10 is implemented.

Images