Target contract distribution method, system and device, storage medium and program product

Abstract

The embodiment of the invention provides a target contract distribution method, system and device, a storage medium and a program product. The method comprises the following steps: uploading a pre-generated initial contract to a data transaction platform; receiving a data use request sent by a second client through the data transaction platform; adjusting the initial contract based on the data use request to obtain a target contract; and sending the target contract and the target data to a data transaction platform, thereby enabling the data transaction platform to encrypt the target contract, and importing the encrypted target contract and target data into a second client. According to the embodiment of the invention, the target contract and the target data can be stored through the database in the first client or the second client, and the target contract is encrypted and decrypted, so that the protection of data privacy can be realized. According to the embodiment, the data operation behavior of the target data can be effectively constrained and controlled by providing the distribution mechanism of the target contract, and the security of the data is improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method, system, device, storage medium and program product for distributing a target contract. Background Art

[0002] Data exchange is the cornerstone of modern science and technology and economic development. It provides strong support for various businesses and applications. With the rapid development of big data and its applications, application scenarios based on data transactions have emerged. Data demanders and data providers reach a transaction on data. However, during the transaction, due to the lack of a restriction mechanism on the data operation behavior of the data demander, the data demander is prone to use data in an irregular and non-compliant manner, which affects the security of data transactions. Summary of the invention

[0003] The present application provides a target contract distribution method, system, device, storage medium and program product. The target contract can effectively constrain the data operation behavior of the second client on the target data and improve the security of data transactions.

[0004] In a first aspect, an embodiment of the present disclosure provides a method for distributing a target contract, which is applied to a first client, and includes: uploading a pre-generated initial contract to a data trading platform; receiving a data usage request sent by a second client through the data trading platform; wherein the data usage request is generated by the second client based on the initial contract; adjusting the initial contract based on the data usage request to obtain a target contract; sending the target contract and target data to the data trading platform so that the data trading platform encrypts the target contract, and importing the encrypted target contract and target data into the second client; wherein the target contract is used to constrain data operation behaviors of the target data.

[0005] In a second aspect, an embodiment of the present disclosure provides a method for distributing a target contract, which is applied to a second client, and includes: reading an initial contract uploaded by a first client from a data trading platform; generating a data usage request based on the initial contract; sending the data usage request to the data trading platform; receiving an encrypted target contract and target data exported from the data trading platform; wherein the encrypted target contract is obtained by the first client adjusting the initial contract based on the data usage request, and the data trading platform encrypts the target contract; the target data and the target contract are sent by the first client to the data trading platform; wherein the target contract is used to constrain data operation behaviors of the target data.

[0006] In a third aspect, an embodiment of the present disclosure provides a method for distributing a target contract, which is applied to a data trading platform, and includes: receiving an initial contract sent by a first client; receiving a data usage request sent by a second client, and sending the data usage request to the first client; wherein the data usage request is generated by the second client based on the initial contract; receiving a target contract and target data sent by the first client; encrypting the target contract to obtain an encrypted target contract; importing the encrypted target contract and the target data into the second client; wherein the target contract is used to constrain data operation behaviors of the target data.

[0007] In a fourth aspect, an embodiment of the present disclosure also provides a target contract distribution system, the system comprising a first client, a second client and a data trading platform; the first client is used to upload a pre-generated initial contract to the data trading platform; the data trading platform is used for the initial contract sent by the first client; the second client is used for the data trading platform to read the initial contract, generate a data usage request based on the initial contract and send the data usage request to the data trading platform; the first client is also used to adjust the initial contract based on the data usage request sent by the data trading platform to obtain a target contract; and send the target contract and target data to the data trading platform; the data trading platform is also used to: encrypt the target contract, and import the encrypted target contract and the target data into the second client; wherein the target contract is used to constrain data operation behavior of the target data.

[0008] In a fifth aspect, an embodiment of the present disclosure further provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the target contract distribution method as described in the embodiment of the present disclosure.

[0009] In a sixth aspect, an embodiment of the present disclosure further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute the target contract distribution method as described in the embodiment of the present disclosure.

[0010] In a seventh aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which, when executed by a processor, implements the target contract distribution method as described in the embodiment of the present disclosure.

[0011] The technical solution of the disclosed embodiment is to upload a pre-generated initial contract to a data trading platform; receive a data usage request sent by a second client through the data trading platform; wherein the data usage request is generated by the second client based on the initial contract; adjust the initial contract based on the data usage request to obtain a target contract; send the target contract and target data to the data trading platform so that the data trading platform encrypts the target contract, and imports the encrypted target contract and target data into the second client; wherein the target contract is used to constrain the data operation behavior of the target data. The disclosed embodiment, by providing a distribution mechanism for the target contract, can effectively constrain and control the data operation behavior of the target data, thereby improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0013] Figure 1 A flow chart of a target contract distribution method provided in an embodiment of the present application;

[0014] Figure 2 A flow chart of a target contract distribution method provided in an embodiment of the present application;

[0015] Figure 3 A flow chart of a target contract distribution method provided in an embodiment of the present application;

[0016] Figure 4 A schematic diagram of the system architecture of a target contract distribution method provided in an embodiment of the present application;

[0017] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should be understood that the various steps recorded in the method implementation of the present disclosure can be performed in different orders and / or in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect. The term "including" and its variations used herein are open inclusions, that is, "including but not limited to". It should be noted that the concepts of "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units. It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative and not restrictive, and those skilled in the art should understand that unless otherwise clearly stated in the context, it should be understood as "one or more". It is understandable that the data involved in the present technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of the corresponding laws, regulations and relevant provisions.

[0020] Figure 1 A flow chart of a target contract distribution method provided in an embodiment of the present application. Applied to a first client, optionally, implemented by an electronic device, which may be a mobile terminal, a PC, or a server. Figure 1 As shown, the method includes:

[0021] S110, uploading the pre-generated initial contract to the data trading platform.

[0022] Among them, the data trading platform is used to provide a standardized trading and communication platform for data providers and data demanders. Among them, the initial contract is generated by the first client based on the contract template downloaded from the data trading platform. Among them, the first client can be used as both a data provider and a data demander. It should be noted that, unless otherwise specified, in the following embodiments, the first client will be used as an example for explanation as a data provider, and the second client will be used as an example for explanation as a data demander. In this embodiment, there is no restriction on the first client, for example, it can be an electronic device such as a mobile phone, a computer, etc. that can interact with the data trading platform and the second client. Among them, the first client includes a first sandbox; the first sandbox includes a first database. The first database is used to store the target data, initial contract, target contract, and parsing rules imported by the first client. The first sandbox also includes a Structured Query Language (SQL) gateway, which is a middleware used to process security-related tasks such as data operation behavior access control and identity authentication during data transmission. In order to distinguish it from the SQL gateway in the second client, the SQL gateway in this first client is recorded as the first SQL gateway. The first SQL gateway is used to parse the target data based on the parsing rules and the target contract to make the target contract effective. The first SQL gateway determines whether the data operation behavior of the first client complies with the provisions of the target contract. When the first client acts as a data provider, the function of the first sandbox is mainly used to store data. When the first client acts as a data demander, the functions of the first sandbox include data storage, parsing, judgment, etc. The first database can be a SQL database.

[0023] In this embodiment, based on the security transaction level of the target data, the corresponding contract template can be downloaded from the data trading platform, the corresponding initial contract can be generated based on the contract template and the target data, and the target data and the initial contract can be imported into the first sandbox, and the target data and the initial contract can be exported from the first sandbox and uploaded to the data trading platform.

[0024] Optionally, the initial contract is generated by: generating an initial contract based on a contract template and target data that have passed the legality check of the data trading platform; wherein, the contract template is verified by: converting a first text format of the contract template into a second text format to perform a legality check on the contract template under the second text format.

[0025] Wherein, the contract template is any one of a plurality of contract templates with different constraint levels. In this embodiment, there is no restriction on the contract template, and it can be divided into: trial contract template, low-sensitivity data formal use contract template, and sensitive data formal use contract template according to the constraint level from low to high (the higher the constraint level, the higher the transaction security level). These three templates can cover the needs of most transaction scenarios. The contract template is defined based on the standard rule language (ODRL) of the European Union's international data space. Open Digital Rights Language (ODRL) is a policy description language for expressing the permissions, conditions, and constraints of digital content when it is shared on the web. It provides a flexible and interoperable information model, vocabulary, and coding framework.

[0026] It should be noted that all contract templates contain 7 baseline rules: audit logs must be recorded; original data set: read-only; it is prohibited to copy an identical table from the original data set; it is prohibited to create a view containing all data on the original table; database permissions: CREATE DATABASE or DROP DATABASE permissions are prohibited; GRANT or REVOKE statements are prohibited; SELECT permissions are granted to allow the demander to query the original data table and its own table; CREATE TABLE, ALTER TABLE, DROP TABLE, INSERT TABLE and other permissions are granted, but limited to tables they create themselves.

[0027] Among them, the trial contract template includes 8 new rules on the basis of 7 baseline rules. The 8 new rules can be respectively: data set restriction: trial data cannot be tampered with; trial data content can only be part of the original data set, such as: 1000 rows; static desensitization is required for specified fields, such as G3-level fields; use specified dynamic desensitization algorithms for specified fields; time limit: the default setting is 1 week; delete after use: delete the original data set within 1 day after the time expires; number of times limit: the number of times used is less than 100; whether to support exporting data sets: not supported; whether to support exporting files: supported.

[0028] Among them, the formal contract template for low-sensitivity data use includes the following 8 rules (including 6 new rules in the trial contract template) on the basis of 7 baseline rules: Dataset restrictions: It is required that the original data product cannot be tampered with or stolen; static desensitization is required for specified fields, such as G3-level fields; specified dynamic desensitization algorithms are used for specified fields; it is prohibited to query all original data without where conditions; it is prohibited to query the specified fields in plain text, that is, whereAlike in("a","b","c"), where A is a sensitive field; time limit: the default setting is 1 year; deletion after use: delete the original data set within 1 week after the time expires; whether to support exporting data sets: not supported; whether to support exporting files: supported.

[0029] Among them, the formal contract template for the use of sensitive data includes all non-repetitive rules in the trial contract template and the formal contract template for the use of low-sensitivity data.

[0030] In this embodiment, each contract template includes constraints or controls on the data operation behavior of the data demander, providing security protection for the target data. The contract template provided in this embodiment includes structured abstract contract content, which can cover most scenarios and ensure the security of data.

[0031] In this embodiment, there is no limitation on the first text format and the second text format. For example, the first text format is JavaScript Object Notation (JSON) format, and the second text format is ODRL format.

[0032] It should be noted that the data trading platform is used to manage the life cycle of the contract template. For example, the first text format of the contract template is converted into the second text format, and the legality of the contract template is verified in the second text format (such as the verification of the effective time). If the verification passes, the contract template is converted into the first text format for storage. If the verification fails, the corresponding contract template is deleted or the relevant staff is notified to modify it.

[0033] In this embodiment, if the first client acts as a data provider, it will select a suitable contract template that has passed the legality verification from the data trading platform according to actual needs or target data, generate an initial contract based on the target data, and import the initial contract into the first sandbox.

[0034] In this embodiment, the method of generating an initial contract based on the contract template and target data after the legality check of the data trading platform, and the method of performing legality check by converting the text format can ensure the compliance of the contract template, enhance the security of the contract template, and protect the legality of data transactions.

[0035] Optionally, before uploading the pre-generated initial contract to the data trading platform, it also includes: uploading the initial contract from the first sandbox to the data trading platform; correspondingly, after adjusting the initial contract based on the data usage request and obtaining the target contract, it also includes: storing the target contract in the first sandbox.

[0036] In this embodiment, if the first client acts as a data provider, the target data, the initial contract, and the target contract can all be stored in the first sandbox, which can achieve physical or logical isolation of the data and improve the security of the data. The sandbox provides a controlled environment, and all data usage behaviors can be recorded and audited, which is convenient for problem tracking and debugging, as well as ensuring the transparency and compliance of data usage. In the first sandbox, the breakpoint resumption of failed contract effectiveness is supported, and the operation is automatically restored from the recorded "breakpoint". The operation and maintenance personnel can also manually roll back according to the records to make the rules effective / invalid or parse the rules.

[0037] S120: Receive a data use request sent by the second client through the data trading platform.

[0038] The data usage request is generated by the second client based on the initial contract.

[0039] In this embodiment, the second client generates a data usage request based on its own needs through the initial contract of the data trading platform, and the data usage request includes opinions on the initial contract, such as extension of the validity period of data usage. Then the data usage request is sent to the first client through the data trading platform.

[0040] S130: Adjust the initial contract based on the data usage request to obtain a target contract.

[0041] In this embodiment, after the first client receives the data usage request through the data trading platform, the initial contract is adaptively modified based on the data usage request, and the modified initial contract is sent to the second client through the data trading platform. If the second client agrees to or receives the modified initial contract, it means that the supply and demand parties have reached an agreement on the contract. The first client stores the agreed initial contract as the target contract in the first sandbox.

[0042] S140: Send the target contract and the target data to the data trading platform, so that the data trading platform encrypts the target contract and imports the encrypted target contract and the target data into the second client.

[0043] The target contract is used to constrain the data operation behavior of the target data.

[0044] In this embodiment, the target contract and target data are uploaded and stored in the data trading platform from the first sandbox, the data trading platform encrypts the target contract, imports the encrypted target contract and the target data into the second client, and the second sandbox in the second client decrypts the encrypted target contract to obtain the decrypted target contract, and then verifies the decrypted target contract. After the verification passes, the target contract is parsed to obtain the parsing rules. The second sandbox controls the operation behavior using the target data through the second SQL gateway in combination with the parsing rules.

[0045] In this embodiment, if the first client, as the data demander, obtains a target contract from the data trading platform in an encrypted form, it needs to be decrypted first and then verified. After the verification, the target contract is parsed to obtain the parsing rules. The first sandbox controls the operation behavior using the target data through the first SQL gateway combined with the parsing rules.

[0046] In this embodiment, the first sandbox may also perform a desensitization operation on the target data through the first SQL gateway to protect sensitive data.

[0047] The technical solution of the disclosed embodiment is to upload a pre-generated initial contract to a data trading platform; receive a data usage request sent by a second client through the data trading platform; wherein the data usage request is generated by the second client based on the initial contract; adjust the initial contract based on the data usage request to obtain a target contract; send the target contract and target data to the data trading platform so that the data trading platform encrypts the target contract, and imports the encrypted target contract and target data into the second client; wherein the target contract is used to constrain the data operation behavior of the target data. The disclosed embodiment, by providing a distribution mechanism for the target contract, can effectively constrain and control the data operation behavior of the target data, thereby improving data security.

[0048] Figure 2 A flow chart of a target contract distribution method provided by an embodiment of the present application. Applied to the second client, optionally, implemented by an electronic device, the electronic device may be a mobile terminal, a PC or a server, etc. Figure 2 As shown, the method includes:

[0049] S210: Read the initial contract uploaded by the first client from the data trading platform.

[0050] Among them, the second client can be used as both a data provider and a data demander. In this embodiment, there is no restriction on the second client, for example, it can be an electronic device such as a mobile phone, a computer, etc. that can interact with the data trading platform and the first client. It should be noted that, unless otherwise specified, in the following embodiments, the first client will be used as an example for explanation as a data provider, and the second client will be used as an example for explanation as a data demander. Among them, the second client includes a second sandbox; the second sandbox includes a second database. The second database is used to store the target data, target contract, and parsing rules imported by the second client. The second sandbox also includes an SQL gateway. In order to distinguish it from the SQL gateway in the first client, the SQL gateway in the second client is recorded as the second SQL gateway. The second SQL gateway is used to parse the target data based on the parsing rules and the target contract to make the target contract effective, and the second SQL gateway determines whether the data operation behavior of the first client complies with the provisions of the target contract. When the second client acts as a data provider, the function of the second sandbox is mainly used to store data. When the second client acts as a data demander, the functions of the second sandbox include functions such as storing data, parsing, and judging. Data is transmitted between the sandbox (first sandbox or second sandbox) and the gateway (first gateway or second gateway) via a dedicated line or a virtual private network (VPN) to ensure data transmission security.

[0051] In this embodiment, based on the security transaction level of the target data, the first client can download the corresponding contract template from the data trading platform, generate the corresponding initial contract based on the contract template and the target data, import the target data and the initial contract into the first sandbox, and export the target data and the initial contract from the first sandbox and upload them to the data trading platform. The second client reads the initial contract uploaded by the first client from the data trading platform.

[0052] S220: Generate a data use request based on the initial contract.

[0053] In this embodiment, the second client generates a data usage request based on its own needs through the initial contract of the data trading platform, and the data usage request includes opinions on the initial contract, such as extension of the validity period of data usage.

[0054] S230: Send the data use request to the data trading platform.

[0055] In this embodiment, the data use request is sent to the first client through the data transaction platform.

[0056] S240: Receive the encrypted target contract and target data exported from the data trading platform.

[0057] Among them, the encrypted target contract is obtained by the first client adjusting the initial contract based on the data usage request, and the data trading platform encrypts the target contract; the target data and the target contract are sent to the data trading platform by the first client; wherein the target contract is used to constrain the data operation behavior of the target data.

[0058] Among them, the second client includes a second sandbox, and the second sandbox includes a SQL gateway; the encrypted target contract includes a target contract summary and encrypted target contract content information; the target contract summary includes a first hash value; and the first hash value is generated by the data trading platform based on the target contract content information.

[0059] Optionally, after receiving the encrypted target contract and target data exported from the data trading platform, it also includes: decrypting the encrypted target contract content information through a second sandbox to obtain the decrypted target contract content information; generating a second hash value based on the decrypted target contract content information; if the first hash value is the same as the second hash value, parsing the decrypted target contract content information to obtain parsing rules, and deploying the parsing rules to the SQL gateway, so as to constrain the data operation behavior of the target data through the SQL gateway in combination with the parsing rules.

[0060] In this embodiment, after receiving the target contract, the data trading platform generates a hash value based on the target contract content information of the target contract using an encryption algorithm, which is recorded as the first hash value, such as an md5 value. The first hash value is then stored in the target contract summary (the target contract summary does not need to be encrypted). The target contract content information is then encrypted to obtain the encrypted target contract content information. The target contract summary and the encrypted target contract content information are sent to the second client, and the second client decrypts the encrypted target contract content information through the second sandbox to obtain the decrypted target contract content information; a hash value is generated based on the decrypted target contract content information, which is recorded as the second hash value, such as an md5 value. The first hash value is obtained from the target contract summary. The first hash value is compared with the second hash value. If the first hash value is the same as the second hash value, the first text format of the decrypted target contract content information is converted to the second text format, and the decrypted target contract content information in the second text format is parsed to obtain the parsing rules. The parsing rules can be understood as the rules for actually controlling data operation behaviors, or the rules that users need to follow when using target data. During the parsing process, the decrypted target contract content information in the second text format is converted into the Ruleclass object of the core layer of the sandbox. The second sandbox will make all the content effective at one time, and handle the invalid ones as exceptions. After obtaining the parsing rules, the parsing rules are deployed to the SQL gateway. The SQL gateway in this embodiment is also the second SQL gateway in the second sandbox in the second client. The data operation behavior of the target data is controlled by the second SQL gateway in combination with the parsing rules to form constraints on the data operation behavior of the second client. Exemplarily, when the second client executes the data operation behavior prohibited in the target contract (target contract content information or parsing rules), the second sandbox gives a friendly error message through the second SQL gateway, such as prompting the user that he does not have permission or exceeds the scope of the contract.

[0061] In this embodiment, when the parsing rules are deployed to the SQL gateway, it can indicate that the data transaction is successful, and the target contract cannot be modified afterwards. If the target contract needs to be modified, it is necessary to terminate the target contract through the data trading platform, re-trade and create a new target contract, and import it into the second sandbox.

[0062] In this embodiment, the method of converting the first text format of the contract template or the decrypted target contract content information into the second text format can semi-structure and abstract the contract template or the decrypted target contract content information into a computer expression form so that the computer can recognize it.

[0063] Among them, the key used by the data trading platform to encrypt the target contract content information and the key used by the second client to decrypt the encrypted target contract content information are a pair of symmetric keys, which are issued by the key management center.

[0064] In this embodiment, the data trading platform encrypts the target contract content information, and the second client decrypts the encrypted target contract content information through the second sandbox and verifies the encrypted target contract content information, which can prevent the target contract from being tampered with and ensure data security.

[0065] The technical solution of the disclosed embodiment is to read the initial contract uploaded by the first client from the data trading platform; generate a data usage request based on the initial contract; send the data usage request to the data trading platform; receive the encrypted target contract and target data exported from the data trading platform; wherein the encrypted target contract is obtained by the first client adjusting the initial contract based on the data usage request, and the data trading platform encrypts the target contract; the target data and the target contract are sent to the data trading platform by the first client; wherein the target contract is used to constrain the data operation behavior of the target data. The disclosed embodiment can effectively constrain and control the data operation behavior of the target data and improve the security of the data by providing a distribution mechanism for the target contract.

[0066] Figure 3 A flow chart of a target contract distribution method provided by an embodiment of the present application. Applied to a data trading platform, optionally, implemented by an electronic device, which may be a mobile terminal, a PC or a server. Figure 3 As shown, the method includes:

[0067] S310: Receive an initial contract sent by the first client.

[0068] S320: Receive a data use request sent by the second client, and send the data use request to the first client.

[0069] The data usage request is generated by the second client based on the initial contract.

[0070] S330: Receive the target contract and target data sent by the first client.

[0071] S340: Encrypt the target contract to obtain the encrypted target contract.

[0072] S350: Import the encrypted target contract and the target data into the second client.

[0073] The target contract is used to constrain the data operation behavior of the target data.

[0074] Optionally, after encrypting the target contract and obtaining the encrypted target contract, it also includes: if the storage time corresponding to the encrypted target contract exceeds a set period, deleting the target data and the encrypted target contract.

[0075] In this embodiment, the first client sets an effective period for the target contract before uploading the target contract to the data trading platform, which is recorded as the set period, such as a one-year effective period starting from. After the first client uploads the target contract and target data to the data trading platform, the data trading platform encrypts the target contract content information in the target contract, and stores the encrypted target contract content information, target contract summary and target data. The data trading platform detects the effective period of the encrypted target contract (including the encrypted target contract content information and the target contract summary) in real time, and deletes it if it exceeds the set period. Exemplarily, if the storage time (or effective time) corresponding to the encrypted target contract content information exceeds the set period, the target data, the encrypted target contract content information and the target contract summary are deleted, and the decrypted target contract (including the decrypted target contract content information and the target contract summary) and the target data in the second client are also invalid. For example, if the set period is one year and the storage period is one year and one month, it means that the set period has been exceeded.

[0076] In this embodiment, the target data and target contracts that exceed the set period are deleted, which can strengthen data privacy protection and compliance, and prevent improper access to outdated data and potential security risks.

[0077] The technical solution of the disclosed embodiment is to read the initial contract uploaded by the first client from the data trading platform; generate a data usage request based on the initial contract; send the data usage request to the data trading platform; receive the encrypted target contract and target data exported from the data trading platform; wherein the encrypted target contract is obtained by the first client adjusting the initial contract based on the data usage request, and the data trading platform encrypts the target contract; the target data and the target contract are sent to the data trading platform by the first client; wherein the target contract is used to constrain the data operation behavior of the target data. The disclosed embodiment can effectively constrain and control the data operation behavior of the target data and improve the security of the data by providing a distribution mechanism for the target contract.

[0078] Figure 4A schematic diagram of the system architecture of a target contract distribution method provided in an embodiment of the present application. The system includes a first client, a second client, and a data trading platform; the first client is used to upload a pre-generated initial contract to the data trading platform; the data trading platform is used for the initial contract sent by the first client; the second client is used for the data trading platform to read the initial contract, generate a data usage request based on the initial contract, and send the data usage request to the data trading platform; the first client is also used to adjust the initial contract based on the data usage request sent by the data trading platform to obtain a target contract; and send the target contract and target data to the data trading platform; the data trading platform is also used to: encrypt the target contract, and import the encrypted target contract and target data into the second client; wherein the target contract is used to constrain the data operation behavior of the target data.

[0079] According to the technical solution of the embodiment of the present disclosure, the first client uploads the pre-generated initial contract to the data trading platform; the data trading platform sends the initial contract to the first client; the second client reads the initial contract, generates a data usage request based on the initial contract, and sends the data usage request to the data trading platform; the first client adjusts the initial contract based on the data usage request sent by the data trading platform to obtain a target contract; and sends the target contract and target data to the data trading platform; the data trading platform encrypts the target contract and imports the encrypted target contract and target data into the second client; the second client decrypts the encrypted target contract content information through the second sandbox to obtain the decrypted target contract content information; generates a second hash value based on the decrypted target contract content information; if the first hash value is the same as the second hash value, parses the decrypted target contract content information to obtain a parsing rule, and deploys the parsing rule to the SQL gateway, so as to constrain the data operation behavior of the target data through the SQL gateway in combination with the parsing rule. The disclosed embodiments, by providing a target contract distribution mechanism, can effectively constrain and control data operation behaviors of target data, thereby improving data security.

[0080] Figure 5A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0081] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0082] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0083] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the distribution of the method target contract.

[0084] In some embodiments, the distribution of the method target contract may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the distribution of the method target contract described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the distribution of the method target contract in any other suitable manner (e.g., by means of firmware).

[0085] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0086] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow charts and / or block diagrams are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0087] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0088] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0089] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0090] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0091] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements a target contract distribution method as provided in any embodiment of the present application.

[0092] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present application, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0093] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A method for distributing a target contract, characterized in that: Applied to the first client, including: Upload the pre-generated initial contract to the data trading platform; receiving a data usage request sent by a second client through the data trading platform; wherein the data usage request is generated by the second client based on the initial contract; Adjusting the initial contract based on the data usage request to obtain a target contract; The target contract and target data are sent to the data trading platform so that the data trading platform encrypts the target contract and imports the encrypted target contract and target data into the second client; wherein the target contract is used to constrain data operation behaviors of the target data.

2. The method according to claim 1, characterized in that The initial contract is generated as follows: An initial contract is generated based on the contract template and target data that have passed the legality check of the data trading platform; wherein the contract template is verified in a manner of: converting a first text format of the contract template into a second text format, so as to perform a legality check on the contract template under the second text format; wherein the contract template is any one of a plurality of contract templates with different constraint levels.

3. The method according to claim 1, characterized in that in, The first client includes a first sandbox; before uploading the pre-generated initial contract to the data trading platform, it also includes: Uploading the initial contract from the first sandbox to the data trading platform; Accordingly, after adjusting the initial contract based on the data use request to obtain the target contract, the method further includes: The target contract is stored in the first sandbox.

4. A method for distributing a target contract, characterized in that: Applied to the second client, including: Read the initial contract uploaded by the first client from the data trading platform; generating a data use request based on the initial contract; Sending the data usage request to the data trading platform; Receive the encrypted target contract and target data exported from the data trading platform; wherein the encrypted target contract is obtained by the first client adjusting the initial contract based on the data usage request, and the data trading platform encrypts the target contract; the target data and the target contract are sent to the data trading platform by the first client; wherein the target contract is used to constrain data operation behaviors of the target data.

5. The method according to claim 4, characterized in that in, The second client includes a second sandbox, and the second sandbox includes a SQL gateway; the encrypted target contract includes a target contract summary and encrypted target contract content information; The target contract digest includes a first hash value; The first hash value is generated by the data trading platform based on the target contract content information; After receiving the encrypted target contract and target data exported from the data trading platform, the method further includes: Decrypting the encrypted target contract content information through the second sandbox to obtain the decrypted target contract content information; Generate a second hash value based on the decrypted target contract content information; If the first hash value is the same as the second hash value, the decrypted target contract content information is parsed to obtain a parsing rule, The parsing rules are deployed to the SQL gateway, so as to constrain the data operation behavior of the target data through the SQL gateway in combination with the parsing rules.

6. A method for distributing a target contract, characterized in that: Applied to data trading platforms, including: Receive the initial contract sent by the first client; receiving a data usage request sent by the second client, and sending the data usage request to the first client; wherein the data usage request is generated by the second client based on the initial contract; Receiving the target contract and target data sent by the first client; Encrypting the target contract to obtain an encrypted target contract; Import the encrypted target contract and the target data into the second client; wherein the target contract is used to constrain data operation behaviors of the target data.

7. The method according to claim 6, characterized in that After encrypting the target contract to obtain the encrypted target contract, the method further includes: If the storage duration corresponding to the encrypted target contract exceeds the set period, the target data and the encrypted target contract will be deleted.

8. A target contract distribution system, characterized in that: The system includes a first client, a second client and a data trading platform; The first client is used to upload the pre-generated initial contract to the data trading platform; The data trading platform is used for the initial contract sent by the first client; The second client is used for the data trading platform to read the initial contract, generate a data use request based on the initial contract, and send the data use request to the data trading platform; The first client is further configured to adjust the initial contract based on the data usage request sent by the data trading platform to obtain a target contract; and send the target contract and target data to the data trading platform; The data trading platform is also used to: encrypt the target contract, and import the encrypted target contract and the target data into the second client; wherein the target contract is used to constrain data operation behaviors of the target data.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the target contract distribution method as described in any one of claims 1-7.

10. A storage medium comprising computer executable instructions, wherein the computer executable instructions are used to execute the target contract distribution method as described in any one of claims 1 to 7 when executed by a computer processor.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the target contract distribution method as described in any one of claims 1 to 7.

Images