A data security sharing method and system

Abstract

The present invention discloses a data security sharing method and system, which relates to the field of data security technology. The method comprises: receiving data to be shared uploaded by a data provider; slicing the data using a bio-inspired adaptive slicing algorithm; generating a digital fingerprint for each slicing using a multi-dimensional dynamic hash algorithm; encrypting the data slicing using a post-quantum encryption algorithm and storing it in a decentralized network; recording access rights, digital fingerprints and storage location information in a blockchain security account book; verifying access rights when receiving a data request; using multimodal biometric identification for identity authentication; obtaining a digital fingerprint and storage location from the blockchain after verification; obtaining encrypted slicing from a decentralized network and decrypting it; verifying integrity using a digital fingerprint; recombining the slicing that has passed verification to obtain complete data and returning it to the requester. The method realizes efficient data sharing while ensuring data security, and effectively balances data value and privacy protection.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security sharing method and system. Background Art

[0002] With the rapid development of information technology and the deepening of digital transformation, data has become a key resource for driving innovation and decision-making. Data sharing plays an increasingly important role in promoting scientific research cooperation, improving social efficiency and promoting economic development. However, traditional data sharing methods often find it difficult to balance the contradiction between data value mining and privacy protection, and there are many security risks, such as data leakage, unauthorized access and data abuse.

[0003] Existing data sharing technologies mainly use centralized storage and access control mechanisms, which not only have the risk of single point failure, but also make it difficult to implement fine-grained permission management and flexible data access control. In addition, with the continuous expansion of data scale and the increasing complexity of data types, traditional data processing and storage methods face challenges in performance, scalability, and security. Especially in cross-organizational and cross-domain data sharing scenarios, how to ensure the authenticity, integrity, and traceability of data has become a key issue that needs to be solved urgently.

[0004] On the other hand, the rapid development of quantum computing technology poses a potential threat to the existing encryption system. Traditional encryption algorithms become vulnerable to attacks from quantum computers, which poses a serious challenge to the long-term security of data. Therefore, there is an urgent need for a new data security sharing method that can resist quantum computing attacks, ensure long-term data security, flexibly control access rights, and effectively balance data sharing and privacy protection. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a data security sharing method and system to solve the above technical problems.

[0006] To achieve the above object, in a first aspect, a data security sharing method is provided, which comprises the following steps:

[0007] S10: receiving data to be shared that carries access permission information uploaded by a data provider, and sharding the data to be shared according to a biologically inspired adaptive sharding algorithm to obtain a plurality of data shards corresponding to the access permission information;

[0008] S20: Generate a unique digital fingerprint for each data shard according to a multi-dimensional dynamic hash algorithm;

[0009] S30: using a post-quantum encryption algorithm to encrypt each of the data shards to obtain encrypted data shards, distributing and storing the encrypted data shards in a decentralized storage network, and obtaining storage location information of each of the encrypted data shards;

[0010] S40: Recording the access permission information, the digital fingerprint and the storage location information corresponding to each data shard in a blockchain security account book in an associated manner;

[0011] S50: When receiving an access request from a data requester, determining whether the access permission information carried in the access request is consistent with the access permission information recorded in the blockchain security ledger;

[0012] S60: For access requests that comply with the access rights information recorded in the blockchain security ledger, identity verification of the data requester is performed using a multimodal biometric recognition method;

[0013] S70: When the identity authentication is passed, according to the access request, obtaining multiple digital fingerprints and multiple storage location information corresponding to the corresponding multiple data shards from the blockchain security account book;

[0014] S80: acquiring multiple encrypted data slices from the decentralized storage network according to the multiple storage location information, decrypting each acquired encrypted data slice to obtain multiple decrypted data slices, and performing integrity verification on each decrypted data slice using a corresponding digital fingerprint;

[0015] S90: reorganize all decrypted data fragments that have passed integrity verification to obtain complete data corresponding to the data to be shared, and return the complete data to the data requester.

[0016] In a second aspect, a data security sharing system is provided, comprising:

[0017] A data receiving module, used to receive the data to be shared with access permission information uploaded by the data provider;

[0018] A data sharding module, configured to shard the data to be shared according to a biologically inspired adaptive sharding algorithm to obtain a plurality of data shards corresponding to the access permission information;

[0019] A digital fingerprint generation module, used to generate a unique digital fingerprint for each data slice according to a multi-dimensional dynamic hash algorithm;

[0020] A data encryption storage module, used to encrypt each of the data shards using a post-quantum encryption algorithm to obtain encrypted data shards, distribute and store the encrypted data shards in a decentralized storage network, and obtain storage location information of each of the encrypted data shards;

[0021] A blockchain recording module, used to record the access permission information, the digital fingerprint and the storage location information corresponding to each data shard in a blockchain security account book in an associated manner;

[0022] An access request processing module, used to receive an access request from a data requester, and determine whether the access permission information carried in the access request is consistent with the access permission information recorded in the blockchain security ledger;

[0023] An identity authentication module, for authenticating the data requester using a multimodal biometric recognition method for access requests that comply with the access rights information recorded in the blockchain security ledger;

[0024] A digital fingerprint and storage location acquisition module, used to obtain multiple digital fingerprints and multiple storage location information corresponding to the corresponding multiple data shards from the blockchain security account book according to the access request when the identity authentication is passed;

[0025] A data decryption verification module, used to obtain multiple encrypted data slices from the decentralized storage network according to the multiple storage location information, decrypt each of the obtained encrypted data slices to obtain multiple decrypted data slices, and use a corresponding digital fingerprint to verify the integrity of each of the decrypted data slices;

[0026] The data reassembly and return module is used to reassemble all the decrypted data fragments that have passed the integrity verification to obtain the complete data corresponding to the data to be shared, and return the complete data to the data requester.

[0027] In a third aspect, an electronic device is provided, comprising:

[0028] one or more processors;

[0029] a storage device for storing one or more programs,

[0030] When the one or more programs are executed by the one or more processors, the one or more processors implement the data security sharing method as described in the first aspect.

[0031] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method for secure data sharing as described in the first aspect is implemented.

[0032] The above technical solution has the following beneficial technical effects:

[0033] The present invention adopts a biologically inspired adaptive sharding algorithm, a multi-dimensional dynamic hash algorithm and a post-quantum encryption algorithm, combined with decentralized storage and blockchain technology, to build a multi-security protection mechanism. This can not only effectively resist current security threats, but also has the ability to resist quantum computing attacks, ensuring the long-term security of data.

[0034] The present invention achieves fine-grained permission management by associating access permission information with data shards and recording them in the blockchain security ledger. Combined with multimodal biometric identity authentication, the security and reliability of access control are further enhanced, effectively preventing unauthorized access.

[0035] The present invention uses a digital fingerprint generated by a multi-dimensional dynamic hash algorithm to verify the integrity of each data slice, ensuring that the data is not tampered with during transmission and storage, and ensuring the authenticity and credibility of shared data.

[0036] The bio-inspired adaptive sharding algorithm of the present invention can perform intelligent sharding according to data characteristics and access rights, thereby improving the efficiency of data processing and transmission. The use of a decentralized storage network enhances the scalability and fault tolerance of the system.

[0037] The present invention achieves efficient data sharing while effectively protecting the privacy and intellectual property rights of data providers through data sharding, encrypted storage and blockchain-based access control.

[0038] The present invention uses blockchain technology to record data operations and access history, achieves traceability and transparency of the entire data sharing process, and helps to build a trusted data sharing ecosystem. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0040] Figure 1 is a flow chart of a data security sharing method according to an embodiment of the present invention;

[0041] Figure 2 is a specific flow chart of step S10 of an embodiment of the present invention;

[0042] Figure 3 is a specific flow chart of step S20 of an embodiment of the present invention;

[0043] Figure 4 is a specific flow chart of step S30 of an embodiment of the present invention;

[0044] Figure 5is a specific flow chart of step S60 of an embodiment of the present invention;

[0045] Figure 6 is a specific flow chart of step S80 of an embodiment of the present invention;

[0046] Figure 7 is a specific flow chart of step S90 of an embodiment of the present invention;

[0047] Figure 8 is a specific flow chart of step S100 of an embodiment of the present invention;

[0048] Fig. 9 It is a structural diagram of a data security sharing system according to an embodiment of the present invention;

[0049] Fig.10 It is a schematic diagram of the structure of a computer system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0051] Embodiment 1

[0052] like Figure 1 As shown, an embodiment of the present invention provides a data security sharing method, which specifically includes the following steps:

[0053] S10: receiving the data to be shared that carries access permission information uploaded by the data provider, and slicing the data to be shared according to a biologically inspired adaptive slicing algorithm to obtain a plurality of data slicings corresponding to the access permission information.

[0054] Specifically, the data provider can be an entity such as an enterprise, a research institution or an individual. The data to be shared can be various types of data, such as text, images, audio or video. Access permission information can include data access level, validity period, accessible user groups, etc. The biologically inspired adaptive sharding algorithm draws on the self-organization and adaptability mechanisms in biological systems, such as cell division or the plasticity of neural networks. It can dynamically adjust the sharding strategy based on multiple dimensions such as the semantic content, structural characteristics, and sensitivity of the data. For example, for documents containing information of various sensitivity levels, the algorithm will divide highly sensitive paragraphs into smaller fragments and assign stricter access permissions, while using larger shard sizes for ordinary content to improve processing efficiency. This approach not only improves security, but also optimizes storage and transmission efficiency.

[0055] In one embodiment, the access permission information includes any number of the following: geographic boundaries, used to determine the geographic scope within which the data to be shared can be accessed; access frequency threshold, used to determine the maximum number of access times allowed for the data to be shared; multi-level access permissions, including read-only permissions, editing permissions, download permissions, and sharing permissions; data sensitivity types, including public data, internal data, confidential data, and top secret data; permission validity period, used to determine the effective time point and expiration time point of the access permission; temporary access permission, used to assign temporary access permissions within a preset time period when the trigger condition is met; and the identity of the user allowed to access, used to ensure that the data to be shared is only accessed by authorized users.

[0056] S20: Generate a unique digital fingerprint for each of the data fragments according to a multi-dimensional dynamic hash algorithm.

[0057] Specifically, the multi-dimensional dynamic hash algorithm introduces dynamic factors based on the traditional hash algorithm, including timestamp, serial number of data block, hash value of the previous data block, etc. The introduction of these dynamic factors makes it possible for data blocks with the same content to generate different hash values ​​at different times or locations, increasing the difficulty of data tampering or replacement. At the same time, this dynamic feature also facilitates version control and change tracking of data. For example, an algorithm similar to SHA-3 (Secure Hash Algorithm 3) can be used, but a dynamic salt value is introduced during the calculation process. This dynamic salt value is related to certain characteristics of the data shard, so that even data shards with the same content can generate different digital fingerprints.

[0058] S30: Using a post-quantum encryption algorithm, encrypt each of the data shards to obtain encrypted data shards, distribute and store the encrypted data shards in a decentralized storage network, and obtain storage location information of each of the encrypted data shards.

[0059] Specifically, post-quantum encryption algorithms may include: NTRU (Nth-degree Truncated Polynomial Ring Units) encryption algorithm based on lattice cryptography, McEliece encryption algorithm based on coding theory, and SPHINCS+ signature algorithm based on hash functions, which are able to resist attacks from quantum computers. The encrypted data shards can be stored in a decentralized storage network similar to IPFS (InterPlanetary File System). The storage location of each encrypted data shard can be represented by a unique identifier (such as the content identifier CID in IPFS). This distributed storage method not only improves the availability of data, but also increases the difficulty for attackers to obtain complete data.

[0060] S40: The access permission information, the digital fingerprint and the storage location information corresponding to each data shard are recorded together in the blockchain security ledger.

[0061] Specifically, blockchain security ledgers can be implemented using platforms such as Ethereum or Hyperledger Fabric (an open source blockchain framework for enterprise applications). The relevant information of each data shard can be recorded in the blockchain as a transaction, including access permission information, digital fingerprints, and storage location information. This not only ensures the immutability of information, but also achieves traceability of data operations.

[0062] S50: When an access request from a data requester is received, determine whether the access permission information carried in the access request is consistent with the access permission information recorded in the blockchain security ledger.

[0063] Specifically, the data requester needs to provide the necessary identity information and the data scope required to be accessed when sending an access request. The system will query the blockchain security ledger based on this information to verify whether the requester has the authority to access the requested data shard. For example, if the requester requests data with access level 3, but its authority is only level 2, it will be rejected by the system.

[0064] S60: For access requests that comply with the access permission information recorded in the blockchain security ledger, a multimodal biometric recognition method is used to authenticate the data requester.

[0065] Specifically, multimodal biometrics can combine multiple biometrics, such as fingerprints, facial recognition, iris scans, brain waves, etc., to improve the accuracy and security of identity authentication. For example, the system can require users to provide both fingerprints and facial recognition, and only if both are verified can they continue to access. This multi-factor authentication reduces the risk of identity fraud.

[0066] S70: When the identity authentication is passed, according to the access request, obtain multiple digital fingerprints and multiple storage location information corresponding to the corresponding multiple data shards from the blockchain security ledger.

[0067] Specifically, once identity authentication is passed, the system will retrieve the digital fingerprint and storage location information of the relevant data shard from the blockchain security ledger based on the requested data range.

[0068] S80: According to the plurality of storage location information, a plurality of encrypted data shards are obtained from the decentralized storage network, each of the obtained encrypted data shards is decrypted to obtain a plurality of decrypted data shards, and integrity verification is performed on each of the decrypted data shards using a corresponding digital fingerprint.

[0069] Specifically, the system retrieves the encrypted data shards from the decentralized storage network based on the storage location information, and then decrypts them using the corresponding post-quantum decryption algorithm. After decryption, the system recalculates the digital fingerprint of each data shard and compares it with the original digital fingerprint stored in the blockchain to verify the integrity and authenticity of the data. If any mismatch is found, the system will mark the shard as potentially tampered with and trigger a security alarm.

[0070] S90: reorganize all decrypted data fragments that have passed integrity verification to obtain complete data corresponding to the data to be shared, and return the complete data to the data requester.

[0071] Specifically, after the integrity verification is passed, the system will reorganize the data fragments according to the predetermined order and rules to restore the original complete data. This process includes data decompression, format conversion and other operations. Finally, the system will securely transmit the reorganized complete data to the data requester. During the entire process, the system will record detailed logs of data access, including access time, access user, access data range and other information for subsequent auditing and tracking.

[0072] The method of the embodiment of the present invention realizes the full life cycle protection from data generation, storage, transmission to access, which can not only effectively resist the current security threats, but also has advantages in data protection in the post-quantum era. The dynamic adaptability and robustness of the system enable it to flexibly respond to complex and changeable data sharing scenarios, while protecting the privacy and intellectual property rights of data providers through fine-grained access control and multimodal biometric recognition. This method cleverly balances high security requirements with efficient data processing, and achieves the unity of efficiency and scalability through distributed storage and parallel processing mechanisms, which is particularly suitable for cross-organizational and cross-domain data sharing needs in the big data era. The combination of multi-dimensional dynamic hashing and blockchain technology not only ensures the integrity and authenticity of the data, but also realizes the full traceability of data operations.

[0073] Embodiment 2

[0074] like Figure 2 As shown, in a specific embodiment of the present invention, step S10 specifically includes the following sub-steps:

[0075] S11: receiving the data to be shared uploaded by the data provider, wherein the data to be shared carries access permission information.

[0076] Specifically, this step receives the data to be shared provided by the data provider through a secure data upload interface. The data can be of various types, such as text, images, audio or video. When uploading data, the data provider also provides access rights information related to the data, such as the type of user who can access the data, access time limit, allowed operation type, etc.

[0077] S12: Perform a preliminary analysis on the data to be shared to obtain data features.

[0078] Specifically, this step uses data analysis algorithms to scan and analyze the uploaded data. These algorithms include Natural Language Processing (NLP) algorithms for text analysis, Convolutional Neural Network (CNN) for image recognition, Fourier transform and Mel-Frequency Cepstral Coefficients (MFCC) for audio analysis, optical flow algorithms for video processing, and decision trees or random forests for structured data analysis. For example, for a report containing text and charts, the system will identify the topic and key terms of the text part, as well as the type and complexity of the charts.

[0079] S13: Acquire the overall operation status of the decentralized storage network in real time, and quantify the overall operation status according to a preset quantification rule to obtain a quantified network status indicator.

[0080] Specifically, this step continuously monitors various indicators of the decentralized storage network through a distributed monitoring system. This monitoring system includes network probes, centralized data collectors, real-time analysis engines, and visualization dashboards. The monitored indicators include the number of nodes, storage capacity, network bandwidth, response time, etc. Quantization rules include linear mapping, logarithmic transformation, threshold classification, normalization, and weighted average. Linear mapping maps the original data to a new range in proportion to maintain the relative relationship of the data; logarithmic transformation is suitable for processing data spanning multiple orders of magnitude, which can compress the data range and highlight the differences between small values; threshold classification divides continuous data into discrete categories according to predefined thresholds to simplify data representation; normalization adjusts features of different scales to the same scale to eliminate the impact of dimensions; weighted average considers the relative importance of multiple factors and comprehensively calculates the final score by assigning different weights. For example, the network response time can be converted into a score of 1-10, where 1 represents an extremely slow response and 10 represents an extremely fast response. This quantification process allows the network state to be used as input for machine learning models.

[0081] S14: Input the data features, the quantified network status indicators and the preset security requirements into a pre-trained cell division model based on a deep learning algorithm to obtain corresponding division rules.

[0082] Specifically, this step utilizes a pre-trained deep learning model that simulates the process of biological cell division. The model receives three types of input: data features, network status indicators, and preset security requirements. The preset security requirements may include any number of minimum shard size, encryption strength (e.g., 128-bit, 256-bit encryption algorithms), redundancy, geographic distribution requirements, and access frequency restrictions. Based on these inputs, the deep learning model outputs a set of optimal splitting rules, which include shard size, sharding method, encryption method, etc. For example, for a report containing sensitive financial information, if the network status is good, the deep learning model will recommend that the text part be split into multiple small fragments, while the chart part remains intact.

[0083] The splitting rules specifically include the following aspects: the shard size specifies the specific number of bytes or records for each data shard, which will be dynamically adjusted according to the data type and network conditions; the sharding method determines how to divide the data, which can be sequential, random, or content-based intelligent splitting; the encryption method specifies the type of encryption algorithm and key length used for each shard; in addition, the splitting rules can also include data distribution strategies (such as geographically dispersed storage), redundancy settings (specifying the number of duplicate storage copies), access control strategies (such as setting access frequency limits or multi-factor authentication requirements), etc. For example, for highly sensitive financial data, when the network conditions are good, the model will recommend dividing the data into smaller fragments (such as 10KB per fragment), encrypting it with 256-bit AES (Advanced Encryption Standard), storing copies in three different geographical locations, and requiring two-factor authentication for access. These detailed rules ensure that the data splitting process can balance security, performance, and availability to the greatest extent.

[0084] This cell division model based on deep learning algorithm adopts a hybrid architecture of multi-layer convolutional neural network (CNN) and long short-term memory network (LSTM).

[0085] The input layer of the model includes three parallel input channels: a data feature channel (e.g., file size, type, importance, etc.), a network status indicator channel (e.g., bandwidth, latency, number of nodes, etc.), and a security requirement channel (e.g., encryption strength, geographic distribution requirements, etc.). Each input channel first passes through an independent CNN sub-network for feature extraction. These CNN sub-networks consist of multiple convolutional layers and pooling layers to extract high-level feature representations of their respective domains. These high-level feature representations are then fused through a fully connected layer to generate a comprehensive feature vector. The comprehensive feature vector contains integrated information of data features, network status, and security requirements. This comprehensive feature vector is input to the LSTM layer, which is specifically designed to process time series changes in network status. The LSTM layer is able to capture these time-related patterns and integrate them into the decision-making process, allowing the model to adapt to dynamic changes in network status. The output of the LSTM layer is further processed and feature transformed through multiple fully connected layers, which maps the time series features captured by the LSTM to the final decision space. The outputs of these fully connected layers are then passed to the last layer of the model, the softmax layer, to generate the final splitting rule parameters, such as shard size, sharding method, encryption method, etc. The model training process uses the cross entropy loss function, combined with the back-propagation algorithm and the Adam (Adaptive Moment Estimation) optimizer. The training dataset contains a large number of historical data splitting cases and their effect evaluations to ensure that the model can learn the optimal splitting strategy. This architectural design allows the model to consider both static features (data features and security requirements) and dynamic features (time changes in network status) to generate splitting rules that are more adapted to actual conditions. The use of CNN is conducive to extracting complex spatial features, while the introduction of LSTM enables the model to consider the changing patterns in time series, especially when dealing with network status indicators that change over time.

[0086] As an alternative implementation, a decision tree-based random forest algorithm can be used to achieve similar functions. Random forest consists of multiple decision trees, each of which is trained based on a different subset of features and data. Input features include data features (such as file size, type), network status indicators (such as bandwidth, latency), and security requirements (such as encryption strength, geographic distribution requirements). Each decision tree independently evaluates these features and gives recommendations for splitting rules. The final splitting rule is obtained by integrating the outputs of all decision trees and using majority voting or average.

[0087] S15: Divide the data to be shared according to the splitting rule to obtain multiple data fragments.

[0088] Specifically, this step performs the actual data sharding operation according to the splitting rules obtained in the previous step. This involves reorganizing, segmenting, and encoding the data. For example, a long document can be segmented into multiple paragraphs or pages, and each part becomes an independent data shard. This sharding method not only takes into account the logical structure of the data, but also takes into account security and network transmission efficiency.

[0089] S16: Match the access permission information with each of the data slices to obtain a plurality of data slices corresponding to the access permission information.

[0090] Specifically, this step associates the access permission information obtained in step S11 with each data slice. Each slice not only contains a part of the original data, but also carries the corresponding access control information. For example, the financial data slice in the report can be marked as "accessible only to the finance department", while the summary slice can be marked as "readable by all employees".

[0091] This embodiment uses a deep learning model to dynamically generate the optimal data sharding strategy by combining data features, network status and security requirements, thereby realizing intelligent and personalized data segmentation. This method not only improves the efficiency of data storage and transmission, but also enhances data security and the accuracy of access control. At the same time, directly associating access permission information with data shards is conducive to subsequent fine-grained access control, effectively balancing the convenience and security of data sharing.

[0092] Embodiment 3

[0093] like Figure 3 As shown, in a specific embodiment of the present invention, step S20 specifically includes the following sub-steps:

[0094] S21: Assign a unique random seed to the current data shard. Specifically, the system uses a cryptographically secure random number generator to generate a unique 128-bit random number as a seed for each data shard. This random seed ensures that even shards with the same content will generate different digital fingerprints.

[0095] S22: Extract feature parameters of multiple dimensions from the current data slice according to preset multi-dimensional feature extraction rules. Specifically, the system applies different feature extraction algorithms according to the data type. For text data, features such as word frequency, sentence length, and the number of times a keyword appears can be extracted; for image data, color histograms, edge features, texture information, etc. can be extracted; for audio data, spectral features, pitch, rhythm, etc. can be extracted.

[0096] S23: Combining the random seed with the characteristic parameters of the multiple dimensions to form an initial hash input. Specifically, the system concatenates the random seed and the extracted characteristic parameters in a predefined format. This combination ensures that the initial hash input contains both randomness (through the random seed) and characteristic information of the data content.

[0097] S24: Perform a first hash operation on the initial hash input using a preset hash function to obtain an intermediate hash value. Specifically, the system uses a secure hash algorithm (such as SHA-256) to calculate the initial hash input. This step further enhances the uniqueness and unpredictability of the digital fingerprint.

[0098] S25: Generate a dynamic factor based on the current timestamp and the overall operation status of the decentralized storage network according to the preset dynamic factor generation rules. Specifically, the system obtains the current Unix timestamp (accurate to milliseconds) and generates a dynamic factor in combination with the network status indicators. The network status indicators here may include: the current number of online nodes, average response time, network bandwidth utilization, storage space utilization, CPU load, memory usage, the number of recent faulty nodes, data replication factor, etc. For example, the system can comprehensively consider indicators such as "number of online nodes: 5000; average response time: 30ms; bandwidth utilization: 65%; storage utilization: 78%; CPU load: 45%; memory utilization: 60%; faulty nodes: 3; replication factor: 3" to generate a dynamic factor. This dynamic factor introduces changes in time and network status, so that even the same data shards will generate different digital fingerprints at different times or network states. Among them, the data replication factor refers to the number of copies of the same data that are copied and stored in a distributed storage system.

[0099] S26: Combining the intermediate hash value with the dynamic factor to form a dynamic hash input. Specifically, the system combines the intermediate hash value and the dynamic factor in a predefined format. This combination ensures that the final digital fingerprint contains both the characteristics of the data content and reflects the time and network status when it was generated.

[0100] S27: Perform a second hash operation on the dynamic hash input using the preset hash function to obtain a digital fingerprint. Specifically, the system uses the SHA-256 algorithm to calculate the dynamic hash input again to obtain a final digital fingerprint. This digital fingerprint uniquely identifies a specific data shard at a specific time and under a specific network state.

[0101] S28: Associating the digital fingerprint with the current data shard. Specifically, the system creates a record in the database, associating the digital fingerprint with the corresponding data shard ID (or storage location). This association allows the system to quickly locate and verify a specific data shard through the digital fingerprint.

[0102] S29: Execute steps S21 to S28 in a loop until all data slices generate corresponding digital fingerprints. Specifically, the system repeats the above steps for each data slice until all slices are processed. This process ensures the integrity and traceability of the entire data set.

[0103] The beneficial technical effects of this embodiment include: by introducing random seeds and multi-dimensional feature extraction, the uniqueness and anti-tampering ability of digital fingerprints are enhanced; by using dynamic factors to reflect the network status, digital fingerprints can adapt to the dynamic characteristics of decentralized storage networks; double hash operations further improve security; the association of digital fingerprints with data shards realizes efficient data integrity verification and tracking. This method can not only effectively prevent data tampering and loss, but also adapt to the dynamic changes in network status, improving the reliability and security of decentralized storage systems.

[0104] Embodiment 4

[0105] like Figure 4 As shown, in a specific embodiment of the present invention, step S30 specifically includes the following sub-steps:

[0106] S31: Generate and store a different encryption key for each data shard.

[0107] Specifically, this step uses a high-strength random number generator to create a unique encryption key for each data shard. For example, the system can use the AES-256 algorithm to generate a 256-bit key for each shard. These keys are securely stored in an encrypted key management system to ensure that only authorized entities can access them.

[0108] S32: Encrypt each data shard according to the post-quantum encryption algorithm and the corresponding encryption key to obtain an encrypted data shard.

[0109] Specifically, this step uses a post-quantum encryption algorithm, such as the New Hope algorithm or the NTRU (Nth-degree Truncated Polynomial Ring Units) lattice cryptographic algorithm, combined with the unique key generated in step S31, to encrypt each data shard. The New Hope algorithm is a post-quantum key exchange protocol based on the ring learning error problem, while the NTRU lattice cryptographic algorithm is a public key encryption system based on the lattice problem in a polynomial ring. These algorithms can not only resist current attacks, but also maintain security when quantum computers appear. The encryption process ensures that even if the data is obtained by unauthorized parties, its content cannot be deciphered.

[0110] S33: Obtain current operating parameters of each storage node in the decentralized storage network.

[0111] Specifically, this step collects the real-time operating status of all storage nodes in the network, including but not limited to: CPU usage, memory usage, storage space margin, network bandwidth, geographic location, online time, historical reliability score, etc. For example, the system collects information such as "Node A: CPU 30%, memory 50%, storage space 70% available, bandwidth 100Mbps, location: a certain city, online time 99.9%, reliability score 9.8 / 10".

[0112] S34: Determine the most suitable storage node for each encrypted data shard according to the current operating parameters of each storage node in the decentralized storage network.

[0113] Specifically, based on the information collected in step S33, the system uses a multi-factor weighted decision algorithm to select the optimal storage node for each encrypted data shard. The intelligent algorithm comprehensively considers multiple factors such as geographical distribution, node performance, reliability history, network latency and storage cost, and dynamically adjusts the weight of each factor according to the importance and characteristics of the data, thereby achieving efficient and reliable storage node selection. The algorithm standardizes each factor and converts indicators of different units (such as CPU usage, storage space margin, network latency, etc.) into a unified scoring standard (such as 0-100 points) to ensure that each factor is comparable and has equal influence. The system assigns an initial weight to each factor and defines the default weight ratio according to typical application scenarios. For example, the geographical distribution weight is 30%, the node performance weight is 25%, the reliability history weight is 20%, the network latency weight is 15%, and the storage cost weight is 10%. These weights reflect the importance of different factors in storage node selection. The algorithm uses a weighted summation method to calculate the comprehensive score of each storage node. Specifically, the comprehensive score is equal to the sum of the product of each factor score and its corresponding weight, that is, score = Σ(factor score * factor weight). This process ensures that the composite score fully reflects the node's performance on all key indicators. The system dynamically adjusts the weights based on the characteristics of the data. For example, for data that needs to be accessed frequently, the weight of network latency will increase; for highly sensitive data, the weight of reliability history will increase. This dynamic adjustment mechanism makes the algorithm highly flexible and able to adapt to different scenarios and needs. The algorithm selects the top N nodes with the highest scores as storage candidates based on the composite score, and the specific number N is determined by the required redundancy. For example, for an important data shard, the system can select three nodes distributed in different regions with high reliability scores and sufficient resources for storage.

[0114] S35: Transmit and store each encrypted data segment to the corresponding most suitable storage node.

[0115] Specifically, this step sends the encrypted data shards to the storage node selected in step S34 via the Transport Layer Security (TLS) protocol. An additional encryption layer is used during the transmission process to ensure the security of the data during transmission. After receiving the data, the storage node will perform an integrity check and save the data in its local storage system.

[0116] S36: Obtain the unique identification and storage location information of each encrypted data shard in the decentralized storage network.

[0117] Specifically, after each storage node successfully saves the data shard, it generates a unique identifier (e.g., a 64-character string generated using the SHA-256 hash algorithm) and detailed storage location information. This information is returned to the central management system. For example, the system may receive information similar to the following: "Shard ID: 7f83b1, storage location: Node A (IP: 192.168.1.100, port: 8080), path: / data / chunks / 7f83b1".

[0118] S37: Establish and store a mapping relationship between the encrypted data slice, the encryption key, the storage location information and the unique identifier.

[0119] Specifically, the system creates and maintains a mapping table in a secure database, which associates the encryption key, storage location, unique identifier, and other information of each data shard. The mapping table itself is also encrypted and can only be accessed by authorized systems or users. For example, a record in the mapping table is as follows:

[0120] {

[0121] "Shard ID": "7f83b1",

[0122] "Encryption Key ID": "key_12345",

[0123] "Storage location": ["Node A (192.168.1.100:8080)", "Node B (192.168.1.101:8080)", "Node C (192.168.1.102:8080)"],

[0124] "Path": [" / data / chunks / 7f83b1", " / data / chunks / 7f83b1", " / data / chunks / 7f83b1"]

[0125] }.

[0126] The advantages of this embodiment are: by using a unique encryption key and post-quantum encryption algorithm for each data shard, data security is improved. By intelligently selecting storage nodes and multi-copy storage, data availability and reliability are improved. Thirdly, the unique identification and detailed storage location information make data retrieval efficient, and specific data shards can be quickly located and accessed even in a large-scale distributed network. The established mapping relationship improves the manageability and traceability of the system for data management, recovery and auditing.

[0127] Embodiment 5

[0128] like Figure 5 As shown, in a specific embodiment of the present invention, step S60 specifically includes the following sub-steps:

[0129] S61: Acquire multimodal biometric data of the data requester, where the multimodal biometric data includes at least two of face data, iris data, voiceprint data, and brainwave data.

[0130] In this step, the system obtains the multimodal biometrics of the data requester through a variety of biometric collection devices. For example, a high-definition camera can be used to collect facial images, a dedicated iris scanner can be used to obtain iris images, a microphone can be used to record sound samples to obtain voiceprint data, and an electroencephalogram (EEG) device can be used to record brain wave data. This multimodal collection method can fully capture the individual's biometrics and improve the accuracy and security of identity authentication. In one example, the collection process can include a user facing the camera to perform a facial scan, while reading a specified text to collect voiceprints, and then completing iris collection through an iris scanner.

[0131] S62: Perform multi-dimensional matching comparison on the multi-modal biometric data and the pre-stored reference biometric template of the data requester to obtain a matching score of each modality.

[0132] In this step, the system will compare the multimodal biometric data just collected with the reference template of the user pre-stored in the database. Each biometric has its own specific comparison algorithm. For example, face recognition can use a deep learning model to extract feature points and calculate similarity; iris recognition can use image processing technology to analyze iris texture; voiceprint recognition can use acoustic feature extraction and pattern matching technology. The system compares each modality separately and generates a matching score for each modality. For example, the face matching score is 0.95, the iris matching score is 0.98, and the voiceprint matching score is 0.92.

[0133] S63: Based on a preset weighted fusion rule, the matching scores of the modalities are comprehensively scored to obtain an identity similarity score.

[0134] In this step, the system uses a predefined weighted fusion rule to combine the matching scores of each modality. This weighting method takes into account the reliability and importance of different biometric features. For example, iris recognition is given a higher weight (e.g. 0.4) because iris features are considered to be the most stable and unique; face recognition receives a medium weight (e.g. 0.3), while voiceprint recognition receives a lower weight (e.g. 0.2). Using linear weighted fusion, the final identity similarity score is calculated as follows: Identity Similarity Score = 0.4 * 0.98 + 0.3 * 0.95 + 0.2 * 0.92 = 0.954.

[0135] S64: Determine whether the identity authentication is passed according to the identity similarity score.

[0136] In this step, the system compares the calculated identity similarity score with the preset threshold to determine whether the identity authentication is successful. The setting of this threshold needs to strike a balance between security and usability. For example, if the threshold is set to 0.95, the identity authentication in the above example will pass. The system can also set multiple threshold levels, such as above 0.98 is highly trusted, 0.95-0.98 is trusted but requires additional verification, and below 0.95 denies access. This grading method can be flexibly adjusted according to the sensitivity of the data and the different access rights.

[0137] By adopting this multi-modal biometric fusion identity authentication method, this embodiment improves the accuracy and security of identity authentication. The combination of multiple biometrics not only increases the difficulty of forgery, but also improves the system's adaptability to different environmental factors. For example, even if the face recognition effect is reduced in poor lighting conditions, the system can still ensure accurate identity authentication through other modalities such as iris or voiceprint. At the same time, the weighted fusion mechanism allows the system to flexibly adjust the verification strategy according to the reliability of different biometrics, further optimizing the effectiveness and robustness of the verification process. This method can not only effectively prevent identity fraud, but also provide users with a more convenient and personalized verification experience, enhancing the overall security of data access control.

[0138] Embodiment 6

[0139] like Figure 6 As shown, in a specific embodiment of the present invention, step S80 specifically includes the following sub-steps:

[0140] S81: According to the multiple storage location information, obtain corresponding multiple encrypted data shards from the decentralized storage network.

[0141] In this step, the system uses the previously obtained storage location information to retrieve and obtain the corresponding encrypted data shards from a decentralized storage network, such as the InterPlanetary File System (IPFS). These storage location information include specific content identifiers (CIDs). For example, suppose a file is divided into 5 encrypted shards, which are stored on different nodes in the IPFS network. The system will send a request to the IPFS network based on the content identifier of each shard and receive the returned encrypted data shards.

[0142] S82: Using a post-quantum decryption algorithm, decrypt each acquired encrypted data shard to obtain multiple decrypted data shards.

[0143] In this step, the system selects the corresponding decryption algorithm based on the specific post-quantum encryption algorithm used during encryption. The details are as follows:

[0144] For data shards encrypted with NTRU, the system uses the NTRU decryption algorithm for decryption. NTRU is an encryption system based on lattice ciphers, and its security is based on the Shortest Vector Problem (SVP) and the Closest Vector Problem (CVP) in the lattice. The decryption process is mainly based on the lattice reduction algorithm.

[0145] For data fragments encrypted using the McEliece algorithm, the system uses the McEliece decryption algorithm for decryption. The McEliece encryption system is based on coding theory and uses Goppa code as the public key. The decryption process mainly involves using the private key to decode the error correction code to restore the original message.

[0146] For data shards signed with SPHINCS+, the system uses the SPHINCS+ verification algorithm for verification. SPHINCS+ is a stateless hash-based signature scheme built using hash functions and pseudo-random functions. The verification process mainly involves using a hash tree algorithm to check the validity of the signature to ensure data integrity and authenticity.

[0147] Therefore, the post-quantum decryption algorithm includes: a lattice-based reduction algorithm based on lattice cryptography (for NTRU decryption), an error-correcting code decoding algorithm based on coding theory (for McEliece decryption), and a hash tree algorithm based on hash functions (for SPHINCS+ verification). These algorithms correspond to the three encryption methods mentioned above, ensuring the consistency and correspondence between the decryption process and the encryption process.

[0148] For example, suppose that among the five encrypted shards, two are encrypted using NTRU, two are encrypted using McEliece, and one is signed using SPHINCS+. The system will apply the corresponding decryption or verification algorithm to these shards respectively, and finally obtain five decrypted data shards.

[0149] S83: For each decrypted data slice, integrity verification is performed using the corresponding digital fingerprint through the following steps:

[0150] Recalculate the digital fingerprint of the currently decrypted data shard using a multi-dimensional dynamic hash algorithm; compare the recalculated digital fingerprint with the digital fingerprint corresponding to the currently decrypted data shard obtained from the blockchain security ledger; when the comparison result is a complete match, determine that the currently decrypted data shard has passed the integrity verification; otherwise, mark the currently decrypted data shard as verification failure.

[0151] In this step, the system verifies the integrity of each decrypted data shard. The system uses SHA-3 (Secure Hash Algorithm 3) as a multi-dimensional dynamic hash algorithm to recalculate the digital fingerprint of each decrypted shard. The system then retrieves the corresponding digital fingerprint previously stored from the blockchain security ledger. For example, for the first data shard, the system calculates a new SHA-3 hash value and then compares it with the original hash value stored on the blockchain. If the two hash values ​​match exactly, the shard is considered to have passed the integrity verification; otherwise, it is marked as verification failure.

[0152] S84: Temporarily store all decrypted data segments that have passed integrity verification in a secure cache area.

[0153] In this step, the system stores all decrypted data slices that have passed integrity verification into a secure temporary cache area. This secure cache is a memory space encrypted with AES-256 to ensure the security of the data during subsequent processing. For example, if 4 out of 5 slices pass integrity verification, then these 4 decrypted data slices will be encrypted with AES-256 and stored in the secure cache.

[0154] By using post-quantum algorithms, the system in this embodiment can resist quantum computing attacks and ensure long-term data security. The SHA-3 hash algorithm and blockchain-based digital fingerprint verification mechanism enhance the protection of data integrity and can effectively detect and prevent data from being tampered with or damaged. The shard-level verification method allows the system to accurately locate and isolate damaged data parts, improving the system's fault tolerance and data recovery flexibility. The use of AES-256 encrypted secure cache area temporarily stores verified data shards, further ensuring the security of data during processing.

[0155] Embodiment 7

[0156] like Figure 7 As shown, in a specific embodiment of the present invention, step S90 specifically includes the following sub-steps:

[0157] Step S91: sort all decrypted data segments that have passed integrity verification according to preset reorganization rules.

[0158] To ensure that the shards can be spliced ​​in the correct order, the system is designed to set a unique sorting identifier for each data shard, such as an ascending serial number or timestamp. The sorting rules can be based on specific algorithms, such as ascending sorting or priority rules. For example, if there are four data shards, and their sorting identifiers are 3, 1, 4, and 2, then according to the ascending rule, the sorting results are: 1, 2, 3, 4.

[0159] Step S92: All decrypted data fragments are sequentially spliced ​​in the sorted order to form preliminary reorganized data.

[0160] After sorting, the system splices the data fragments one by one in the order of the serial numbers. The splicing method can be simple byte stream splicing or structured splicing based on the file format. For example, if the fragment content is "Hello", "this", "is", "data", the preliminary data formed after splicing is "Hello this is data".

[0161] Step S93: performing data verification on the initially reorganized data to obtain a data verification result.

[0162] The purpose of data verification is to detect the integrity and correctness of the spliced ​​data. Verification methods include hash verification, CRC verification, or dedicated redundant data verification. For example, the system pre-stores the hash value of the complete data. If the hash value of the spliced ​​data is consistent with the pre-stored hash value, the verification is successful, otherwise it is considered a verification failure.

[0163] Step S94: if the data verification result meets the preset integrity standard, the initially reorganized data is determined as complete data corresponding to the data to be shared;

[0164] If the verification result meets the integrity standard, it can be confirmed that the spliced ​​data is correct and complete data, and proceed to the next step of processing.

[0165] Step S95: If the data verification result does not meet the preset integrity standard, return to step S91 to re-sort and splice until the data verification result meets the preset integrity standard or reaches the preset maximum number of retries.

[0166] When verification fails, the system will readjust the sorting strategy and try to splice. The maximum number of retries can be set according to needs, such as 10 times, to prevent falling into an infinite loop.

[0167] Step S96: Format the determined complete data so that the formatted complete data meets the receiving requirements of the data requesting party.

[0168] To be compatible with the data requester's system, the system will format the complete data, such as converting it to a specified file format (such as JSON, XML) or adjusting the encoding format. For example, if the requester requires JSON format and the original data is in the string form "Hello this is data", it will be formatted as {"message": "Hello this is data"}.

[0169] Step S97: Transmit the formatted complete data to the data requester through a secure channel.

[0170] To ensure the security of data during transmission, the system uses encrypted transmission technologies such as Transport Layer Security (TLS) and Virtual Private Network (VPN). For example, the TLS protocol is used to send formatted JSON data to the designated server address of the data requester, and the transmission log is recorded for review.

[0171] The technical solution has the following advantages: when the data fragments are reorganized, they are sorted according to the preset reorganization rules and with the help of unique sorting identifiers (such as increasing serial numbers or timestamps), which is conducive to ensuring that the data fragments can be spliced ​​in the correct order. Secondly, data splicing adopts different methods such as byte stream splicing or structured splicing based on file format, which improves flexibility. Furthermore, multiple checks (hash check, CRC check or dedicated redundant data check, etc.) are performed on the preliminary reorganized data, which can effectively detect the integrity and correctness of the data after splicing, and can be reordered and spliced ​​when the check fails, and the maximum number of retries is set to avoid infinite loops to ensure the accuracy of the data. In addition, the complete data is formatted to meet the receiving requirements of the data requester to improve compatibility. Finally, the data is transmitted through a secure channel (encrypted transmission technology such as TLS, VPN) and the transmission log is recorded to ensure the security of the data transmission process.

[0172] Embodiment 8

[0173] like Figure 8As shown, in a specific embodiment of the present invention, the method may further include step S100: implementing a data automatic destruction process based on a smart contract according to the smart contract deployed in the blockchain security account book. This step implements the automated management and control of shared data by deploying a smart contract in the blockchain security account book. As a self-executing computer program, a smart contract can automatically trigger corresponding operations when preset conditions are met, thereby ensuring the security and compliance of data throughout its life cycle.

[0174] Wherein, step S100 may specifically include:

[0175] S101: deploying a smart contract in the blockchain security account book, wherein the smart contract contains preset destruction conditions, and the destruction conditions include at least one of the expiration of the data usage period, the number of data accesses reaching a preset upper limit, and the data provider actively requesting destruction.

[0176] In this step, the system administrator or data provider can deploy a smart contract with preset destruction conditions in the blockchain security ledger. These destruction conditions can be flexibly set according to actual needs. For example, for some sensitive data, the usage period can be set to 30 days; for some high-value data, the maximum number of accesses can be limited to 100 times; at the same time, the data provider can also reserve the right to destroy the data at any time. The setting of these conditions not only protects the rights and interests of the data provider, but also ensures the compliance of data use.

[0177] S102: Control the smart contract to continuously monitor the usage of the data to be shared, and when it is monitored that the destruction condition is met, automatically execute the data destruction operation, and send a deletion instruction to the decentralized storage network to delete the relevant encrypted data shards.

[0178] In this step, the smart contract will continuously monitor the use of the data. For example, it will record the first access time of the data and calculate the remaining usage period; count the number of times the data is accessed; and monitor the destruction request issued by the data provider. Once any destruction condition is detected to be triggered, the smart contract will automatically execute the destruction operation. Specifically, it will send a deletion instruction to the decentralized storage network to delete all encrypted data shards related to the data. This automated destruction mechanism ensures that the data can be deleted in a timely and thorough manner when it exceeds the expected scope of use, minimizing the risk of data leakage.

[0179] S103: Recording the associated information of the data destruction operation in the blockchain security account book, wherein the associated information includes the destruction time, the triggered destruction conditions, and the information of the deleted encrypted data shards.

[0180] After the destruction operation is executed, the smart contract will record detailed destruction operation information in the blockchain security ledger. This information may include: the specific timestamp of the destruction operation execution (for example, 2024-12-05 14:30:15 UTC), the specific conditions that trigger the destruction (for example, the data usage period expires or the number of accesses reaches the upper limit of 100 times), and the identifier or hash value of the deleted encrypted data shard. These records provide a basis for subsequent audits and compliance checks, and also enhance the transparency and traceability of the entire data sharing process.

[0181] S104: Send a notification to the data provider and the data requester, indicating that the relevant encrypted data slices have been destroyed.

[0182] Finally, the smart contract will automatically send a notification to the data provider and all data requesters who have accessed the data. This notification is sent through a pre-set communication channel (such as email, SMS or internal system message), and includes key information such as data identification, upload time, destruction time, and destruction reason. This timely notification mechanism ensures that all relevant parties can understand the changes in data status in a timely manner, which is conducive to maintaining the transparency and trust of the data sharing ecosystem.

[0183] The data automatic destruction process based on smart contracts described in the embodiment of the present invention realizes the automatic management of the data life cycle by deploying smart contracts in the blockchain security account book, thereby improving data security and management efficiency. The continuous monitoring mechanism of smart contracts ensures that data usage is always within a controllable range. Once the preset destruction conditions are triggered, the system can perform the destruction operation in a timely and automatic manner, effectively preventing the risk of data being overused or abused. The automated execution and accurate recording of the destruction operation enhance the transparency and traceability of the entire data sharing process, providing a reliable basis for subsequent audits and compliance checks. The function of sending destruction notifications to relevant parties further enhances the user-friendliness and information transparency of the system. Finally, this automatic destruction mechanism based on smart contracts can adapt to the security requirements of different types of data, and achieves a balance between data sharing and data protection by flexibly setting destruction conditions.

[0184] Embodiment 9

[0185] like Fig. 9 As shown, this embodiment provides a data security sharing system, which includes:

[0186] A data receiving module, used to receive the data to be shared with access permission information uploaded by the data provider;

[0187] A data sharding module, configured to shard the data to be shared according to a biologically inspired adaptive sharding algorithm to obtain a plurality of data shards corresponding to the access permission information;

[0188] A digital fingerprint generation module, used to generate a unique digital fingerprint for each data slice according to a multi-dimensional dynamic hash algorithm;

[0189] A data encryption storage module, used to encrypt each of the data shards using a post-quantum encryption algorithm to obtain encrypted data shards, distribute and store the encrypted data shards in a decentralized storage network, and obtain storage location information of each of the encrypted data shards;

[0190] A blockchain recording module, used to record the access permission information, the digital fingerprint and the storage location information corresponding to each data shard in a blockchain security account book in an associated manner;

[0191] An access request processing module, configured to, upon receiving an access request from a data requester, determine whether the access permission information carried in the access request is consistent with the access permission information recorded in the blockchain security ledger;

[0192] An identity authentication module, for authenticating the data requester using a multimodal biometric recognition method for access requests that comply with the access rights information recorded in the blockchain security ledger;

[0193] A digital fingerprint and storage location acquisition module, used to obtain multiple digital fingerprints and multiple storage location information corresponding to the corresponding multiple data shards from the blockchain security account book according to the access request when the identity authentication is passed;

[0194] A data decryption verification module, used to obtain multiple encrypted data slices from the decentralized storage network according to the multiple storage location information, decrypt each of the obtained encrypted data slices to obtain multiple decrypted data slices, and perform integrity verification on each of the decrypted data slices using a corresponding digital fingerprint;

[0195] The data reassembly and return module is used to reassemble all the decrypted data fragments that have passed the integrity verification to obtain the complete data corresponding to the data to be shared, and return the complete data to the data requester.

[0196] In a further embodiment, the data sharding module specifically includes:

[0197] A data receiving unit, used for receiving the data to be shared uploaded by the data provider, wherein the data to be shared carries access permission information;

[0198] A data analysis unit, used for performing a preliminary analysis on the data to be shared to obtain data features;

[0199] A network status acquisition unit, used to acquire the overall operation status of the decentralized storage network in real time, and quantify the overall operation status according to a preset quantification rule to obtain a quantified network status indicator;

[0200] A splitting rule generating unit, used for inputting the data features, the quantified network status indicators and the preset security requirements into a pre-trained cell splitting model based on a deep learning algorithm to obtain corresponding splitting rules;

[0201] A data partitioning unit, configured to partition the data to be shared according to the splitting rule to obtain a plurality of data fragments;

[0202] The permission corresponding unit is used to correspond the access permission information to each of the data slices to obtain multiple data slices corresponding to the access permission information.

[0203] In a further embodiment, the digital fingerprint generation module specifically includes:

[0204] A random seed allocation unit is used to allocate a unique random seed to the current data shard;

[0205] A feature extraction unit, configured to extract feature parameters of multiple dimensions from the current data slice according to a preset multi-dimensional feature extraction rule;

[0206] An initial hash input generating unit, used for combining the random seed with the characteristic parameters of the multiple dimensions to form an initial hash input;

[0207] A first hash operation unit, configured to perform a first hash operation on the initial hash input using a preset hash function to obtain an intermediate hash value;

[0208] A dynamic factor generation unit, configured to generate a dynamic factor according to a preset dynamic factor generation rule, based on a current timestamp and an overall operating status of the decentralized storage network;

[0209] A dynamic hash input generation unit, configured to combine the intermediate hash value with the dynamic factor to form a dynamic hash input;

[0210] A second hash operation unit, used for performing a second hash operation on the dynamic hash input using the preset hash function to obtain a digital fingerprint;

[0211] an associating unit, configured to associate the digital fingerprint with the current data slice;

[0212] A loop control unit is used to control the loop execution of the random seed allocation unit, the feature extraction unit, the initial hash input generation unit, the first hash operation unit, the dynamic factor generation unit, the dynamic hash input generation unit, the second hash operation unit and the association unit until all data fragments generate corresponding digital fingerprints.

[0213] In a further embodiment, the data encryption storage module specifically includes:

[0214] A key generation unit, used to generate and store different encryption keys for each data shard;

[0215] An encryption processing unit, used to perform encryption processing on each data slice according to a post-quantum encryption algorithm and a corresponding encryption key to obtain an encrypted data slice;

[0216] A node parameter acquisition unit, used to acquire the current operating parameters of each storage node in the decentralized storage network;

[0217] A storage node selection unit, configured to determine the most suitable storage node for each encrypted data shard according to current operating parameters of each storage node in the decentralized storage network;

[0218] A data transmission storage unit, used for transmitting and storing each encrypted data slice to the corresponding most suitable storage node;

[0219] A storage information acquisition unit, used to obtain the unique identification and storage location information of each encrypted data shard in the decentralized storage network;

[0220] A mapping relationship establishing unit is used to establish and store a mapping relationship between the encrypted data slices, the encryption key, the storage location information and the unique identifier.

[0221] In a further embodiment, the identity verification module specifically includes:

[0222] A biometric acquisition unit, configured to acquire multimodal biometric data of the data requester, wherein the multimodal biometric data includes at least two of face data, iris data, voiceprint data, and brainwave data;

[0223] A feature matching unit, configured to perform multi-dimensional matching comparison between the multi-modal biometric data and a pre-stored reference biometric template of the data requester to obtain a matching score for each modality;

[0224] A comprehensive scoring unit, used to comprehensively score the matching scores of the various modes based on a preset weighted fusion rule to obtain an identity similarity score;

[0225] The verification result determination unit is used to determine whether the identity authentication is passed according to the identity similarity score.

[0226] In a further embodiment, the data decryption verification module specifically includes:

[0227] An encrypted data acquisition unit, configured to acquire a corresponding plurality of encrypted data fragments from the decentralized storage network according to the plurality of storage location information;

[0228] A data decryption unit, used to decrypt each acquired encrypted data slice using a post-quantum decryption algorithm to obtain a plurality of decrypted data slices;

[0229] The integrity verification unit is used to perform integrity verification on each decrypted data slice using the corresponding digital fingerprint through the following steps: recalculate the digital fingerprint of the currently decrypted data slice using a multi-dimensional dynamic hash algorithm; compare the recalculated digital fingerprint with the digital fingerprint corresponding to the currently decrypted data slice obtained from the blockchain security account book; when the comparison result is a complete match, determine that the currently decrypted data slice has passed the integrity verification; otherwise, mark the currently decrypted data slice as verification failure;

[0230] The security cache unit is used to temporarily store all decrypted data fragments that have passed integrity verification in the security cache area.

[0231] In a further embodiment, the data reorganization return module specifically includes:

[0232] A data sorting unit, used to sort all decrypted data fragments that have passed integrity verification according to a preset reorganization rule;

[0233] A data splicing unit is used to sequentially splice all the decrypted data fragments in the sorted order to form preliminary reorganized data;

[0234] A data verification unit, used to perform data verification on the preliminarily reorganized data to obtain a data verification result;

[0235] an integrity judgment unit, configured to determine the initially reorganized data as complete data corresponding to the data to be shared if the data verification result satisfies a preset integrity standard; and to control the return to the data sorting unit to re-sort and splice if the data verification result does not meet the preset integrity standard, until the data verification result satisfies the preset integrity standard or reaches a preset maximum number of retries;

[0236] A data formatting unit, used for formatting the determined complete data so that the formatted complete data meets the receiving requirements of the data requesting party;

[0237] The data transmission unit is used to transmit the formatted complete data to the data requester through a secure channel.

[0238] In a further embodiment, the system further comprises:

[0239] The smart contract execution module is used to implement the automatic data destruction process based on the smart contract deployed in the blockchain security ledger.

[0240] In a further embodiment, the smart contract execution module specifically includes:

[0241] A smart contract deployment unit, configured to deploy a smart contract in the blockchain security account book, wherein the smart contract includes a preset destruction condition, wherein the destruction condition includes at least one of the following: expiration of the data usage period, the number of data accesses reaching a preset upper limit, and the data provider actively requesting destruction;

[0242] A data monitoring unit, used to control the smart contract to continuously monitor the usage of the data to be shared, and trigger a data destruction operation when it is monitored that the destruction condition is met;

[0243] A data destruction unit, configured to automatically send a deletion instruction to the decentralized storage network to delete the relevant encrypted data shards when a data destruction operation is triggered;

[0244] A destruction recording unit, used to record the associated information of the data destruction operation in the blockchain security account book, wherein the associated information includes the destruction time, the triggered destruction condition and the information of the deleted encrypted data fragment;

[0245] A notification sending unit is used to send a notification to the data provider and the data requester, indicating that the relevant encrypted data slices have been destroyed.

[0246] In a further embodiment, the access permission information includes any number of the following: geographic boundaries, used to determine the geographic scope within which the data to be shared can be accessed; access frequency threshold, used to determine the maximum number of access times allowed for the data to be shared; multi-level access permissions, including read-only permissions, editing permissions, download permissions and sharing permissions; data sensitivity types, including public data, internal data, confidential data and top secret data; permission validity period, used to determine the effective time point and expiration time point of the access permission; temporary access permission, used to assign temporary access permissions within a preset time period when the trigger condition is met; user identity allowed to access, used to ensure that the data to be shared is only accessed by authorized users.

[0247] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0248] Embodiment 10

[0249] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, any one of the above-mentioned data security sharing methods is implemented.

[0250] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. Of course, there are other forms of readable storage media, such as quantum memory, graphene memory, etc.

[0251] The present invention also provides an electronic device. The electronic device of an embodiment of the present invention comprises: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the data security sharing method provided by the present invention.

[0252] Reference below Fig.10 , which shows a schematic diagram of the structure of a computer system 800 of an electronic device suitable for implementing an embodiment of the present invention. Fig.10 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0253] like Fig.10 As shown, the computer system 200 includes a central processing unit (CPU) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from the storage part 202 to a random access memory (RAM) 203. In the RAM 203, various programs and data required for the operation of the computer system 200 are also stored. The CPU 201, the ROM 202, and the RAM 203 are connected to each other through a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.

[0254] The following components are connected to the I / O interface 205: an input section 206 including a keyboard, a mouse, etc.; an output section 207 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 208 including a hard disk, etc.; and a communication section 209 including a network interface card such as a LAN card, a modem, etc. The communication section 209 performs communication processing via a network such as the Internet. A drive 210 is also connected to the I / O interface 205 as needed. A removable medium 211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 210 as needed so that a computer program read therefrom is installed into the storage section 208 as needed.

[0255] In particular, according to the embodiments disclosed in the present invention, the process described in the main step diagram above can be implemented as a computer software program. For example, the embodiments of the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the main step diagram. In the above embodiment, the computer program can be downloaded and installed from the network through the communication part 209, and / or installed from the removable medium 211. When the computer program is executed by the central processing unit 201, the above functions defined in the system of the present invention are executed.

[0256] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0257] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a portion of a code, and the above-mentioned module, program segment, or a portion of a code contains one or more executable instructions for implementing a specified logical function. The above-mentioned specific implementation methods do not constitute a limitation on the scope of protection of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data security sharing method, characterized in that: The following steps are involved: S10: receiving data to be shared that carries access permission information uploaded by a data provider, and sharding the data to be shared according to a biologically inspired adaptive sharding algorithm to obtain a plurality of data shards corresponding to the access permission information; S20: Generate a unique digital fingerprint for each data shard according to a multi-dimensional dynamic hash algorithm; S30: using a post-quantum encryption algorithm to encrypt each of the data shards to obtain encrypted data shards, distributing and storing the encrypted data shards in a decentralized storage network, and obtaining storage location information of each of the encrypted data shards; S40: Recording the access permission information, the digital fingerprint and the storage location information corresponding to each data shard in a blockchain security account book in an associated manner; S50: When receiving an access request from a data requester, determining whether the access permission information carried in the access request is consistent with the access permission information recorded in the blockchain security ledger; S60: For access requests that comply with the access rights information recorded in the blockchain security ledger, identity verification of the data requester is performed using a multimodal biometric recognition method; S70: When the identity authentication is passed, according to the access request, obtaining multiple digital fingerprints and multiple storage location information corresponding to the corresponding multiple data shards from the blockchain security account book; S80: acquiring multiple encrypted data slices from the decentralized storage network according to the multiple storage location information, decrypting each acquired encrypted data slice to obtain multiple decrypted data slices, and performing integrity verification on each decrypted data slice using a corresponding digital fingerprint; S90: reorganize all decrypted data fragments that have passed the integrity verification to obtain complete data corresponding to the data to be shared, and return the complete data to the data requester; Step S10 specifically includes: S11: receiving data to be shared uploaded by a data provider, wherein the data to be shared carries access permission information; S12: Performing a preliminary analysis on the data to be shared to obtain data features; S13: Acquire the overall operation status of the decentralized storage network in real time, and quantify the overall operation status according to a preset quantification rule to obtain a quantified network status indicator; S14: inputting the data features, the quantified network status indicators and the preset security requirements into a pre-trained cell division model based on a deep learning algorithm to obtain corresponding division rules; S15: Divide the data to be shared according to the splitting rule to obtain multiple data fragments; S16: Matching the access permission information with each of the data slices to obtain a plurality of data slices corresponding to the access permission information; Step S20 specifically includes: S21: Assign a unique random seed to the current data shard; S22: extracting feature parameters of multiple dimensions from the current data slice according to a preset multi-dimensional feature extraction rule; S23: combining the random seed with the characteristic parameters of the multiple dimensions to form an initial hash input; S24: performing a first hash operation on the initial hash input using a preset hash function to obtain an intermediate hash value; S25: Generate a dynamic factor according to a preset dynamic factor generation rule, based on the current timestamp and the overall operation status of the decentralized storage network; S26: Combining the intermediate hash value with the dynamic factor to form a dynamic hash input; S27: performing a second hash operation on the dynamic hash input using the preset hash function to obtain a digital fingerprint; S28: Associating the digital fingerprint with the current data slice; S29: Execute steps S21 to S28 in a loop until all data slices generate corresponding digital fingerprints.

2. The method according to claim 1, characterized in that Step S30 specifically includes: S31: Generate and store different encryption keys for each data shard; S32: Encrypt each data shard according to the post-quantum encryption algorithm and the corresponding encryption key to obtain an encrypted data shard; S33: Obtaining current operating parameters of each storage node in the decentralized storage network; S34: Determine the most suitable storage node for each encrypted data shard according to the current operating parameters of each storage node in the decentralized storage network; S35: Transmit and store each encrypted data slice to the corresponding most suitable storage node; S36: Obtaining the unique identification and storage location information of each encrypted data shard in the decentralized storage network; S37: Establish and store a mapping relationship between the encrypted data slice, the encryption key, the storage location information and the unique identifier.

3. The method according to claim 1, characterized in that Step S60 specifically includes: S61: Acquire multimodal biometric data of the data requester, where the multimodal biometric data includes at least two of face data, iris data, voiceprint data, and brainwave data; S62: performing multi-dimensional matching comparison on the multi-modal biometric data and a pre-stored reference biometric template of the data requester to obtain a matching score of each modality; S63: Based on a preset weighted fusion rule, comprehensively score the matching scores of the modalities to obtain an identity similarity score; S64: Determine whether the identity authentication is passed according to the identity similarity score.

4. The method according to claim 1, characterized in that Step S80 specifically includes: S81: Acquire corresponding multiple encrypted data shards from the decentralized storage network according to the multiple storage location information; S82: Decrypt each of the obtained encrypted data slices using a post-quantum decryption algorithm to obtain multiple decrypted data slices; S83: For each decrypted data slice, perform integrity verification using the corresponding digital fingerprint through the following steps: recalculate the digital fingerprint of the currently decrypted data slice using a multi-dimensional dynamic hash algorithm; compare the recalculated digital fingerprint with the digital fingerprint corresponding to the currently decrypted data slice obtained from the blockchain security ledger; when the comparison result is a complete match, determine that the currently decrypted data slice has passed the integrity verification; otherwise, mark the currently decrypted data slice as verification failure; S84: Temporarily store all decrypted data segments that have passed integrity verification in a secure cache area.

5. The method according to claim 1, characterized in that Step S90 specifically includes: S91: sorting all decrypted data fragments that have passed integrity verification according to a preset reorganization rule; S92: splicing all the decrypted data fragments in sequence according to the sorted order to form preliminary reorganized data; S93: Performing data verification on the preliminarily reorganized data to obtain a data verification result; S94: If the data verification result meets the preset integrity standard, determining the initially reorganized data as complete data corresponding to the data to be shared; S95: If the data verification result does not meet the preset integrity standard, return to step S91 to re-sort and splice until the data verification result meets the preset integrity standard or reaches the preset maximum number of retries; S96: Formatting the determined complete data so that the formatted complete data meets the receiving requirements of the data requesting party; S97: Transmit the formatted complete data to the data requester through a secure channel.

6. The method according to claim 1, characterized in that The following steps are also included: S100: Implement the data automatic destruction process based on the smart contract deployed in the blockchain security ledger.

7. The method according to claim 1, characterized in that The access permission information includes any one of the following: Geographic boundaries, which are used to determine the geographical scope within which the data to be shared can be accessed; The access frequency threshold is used to determine the maximum number of accesses allowed to the data to be shared; Multi-level access permissions, including read-only permissions, editing permissions, download permissions, and sharing permissions; Data sensitivity types, which include public data, internal data, confidential data, and top secret data; Permission validity period, which is used to determine the time when the access permission takes effect and when it expires; Temporary access rights, which are used to assign temporary access rights within a preset time period when the triggering conditions are met; The identity of the user who is allowed to access is used to ensure that the shared data is only accessed by authorized users.

8. A data security sharing system, characterized in that: include: A data receiving module, used to receive the data to be shared with access permission information uploaded by the data provider; A data sharding module, configured to shard the data to be shared according to a biologically inspired adaptive sharding algorithm to obtain a plurality of data shards corresponding to the access permission information; A digital fingerprint generation module, used to generate a unique digital fingerprint for each data slice according to a multi-dimensional dynamic hash algorithm; A data encryption storage module, used to encrypt each of the data shards using a post-quantum encryption algorithm to obtain encrypted data shards, distribute and store the encrypted data shards in a decentralized storage network, and obtain storage location information of each of the encrypted data shards; A blockchain recording module, used to record the access permission information, the digital fingerprint and the storage location information corresponding to each data shard in a blockchain security account book in an associated manner; An access request processing module, used to receive an access request from a data requester, and determine whether the access permission information carried in the access request is consistent with the access permission information recorded in the blockchain security ledger; An identity authentication module, for authenticating the data requester using a multimodal biometric recognition method for access requests that comply with the access rights information recorded in the blockchain security ledger; A digital fingerprint and storage location acquisition module, used to obtain multiple digital fingerprints and multiple storage location information corresponding to the corresponding multiple data shards from the blockchain security account book according to the access request when the identity authentication is passed; A data decryption verification module, used to obtain multiple encrypted data slices from the decentralized storage network according to the multiple storage location information, decrypt each of the obtained encrypted data slices to obtain multiple decrypted data slices, and use a corresponding digital fingerprint to verify the integrity of each of the decrypted data slices; A data reassembly and return module, used for reassembling all decrypted data fragments that have passed integrity verification to obtain complete data corresponding to the data to be shared, and returning the complete data to the data requester; The data sharding module specifically includes: A data receiving unit, used for receiving the data to be shared uploaded by the data provider, wherein the data to be shared carries access permission information; A data analysis unit, used for performing a preliminary analysis on the data to be shared to obtain data features; A network status acquisition unit, used to acquire the overall operation status of the decentralized storage network in real time, and quantify the overall operation status according to a preset quantification rule to obtain a quantified network status indicator; A splitting rule generating unit, used for inputting the data features, the quantified network status indicators and the preset security requirements into a pre-trained cell splitting model based on a deep learning algorithm to obtain corresponding splitting rules; A data partitioning unit, configured to partition the data to be shared according to the splitting rule to obtain a plurality of data fragments; A permission corresponding unit, used for corresponding the access permission information to each of the data slices, to obtain a plurality of data slices corresponding to the access permission information; The digital fingerprint generation module specifically includes: A random seed allocation unit is used to allocate a unique random seed to the current data shard; A feature extraction unit, configured to extract feature parameters of multiple dimensions from the current data slice according to a preset multi-dimensional feature extraction rule; An initial hash input generating unit, used for combining the random seed with the characteristic parameters of the multiple dimensions to form an initial hash input; A first hash operation unit, configured to perform a first hash operation on the initial hash input using a preset hash function to obtain an intermediate hash value; A dynamic factor generation unit, configured to generate a dynamic factor according to a preset dynamic factor generation rule, based on a current timestamp and an overall operating status of the decentralized storage network; A dynamic hash input generation unit, configured to combine the intermediate hash value with the dynamic factor to form a dynamic hash input; A second hash operation unit, used for performing a second hash operation on the dynamic hash input using the preset hash function to obtain a digital fingerprint; an associating unit, configured to associate the digital fingerprint with the current data slice; A loop control unit is used to control the loop execution of the random seed allocation unit, the feature extraction unit, the initial hash input generation unit, the first hash operation unit, the dynamic factor generation unit, the dynamic hash input generation unit, the second hash operation unit and the association unit until all data shards generate corresponding digital fingerprints.

Images