Data sharing method, electronic device, storage medium and program product

Abstract

The embodiment of the invention provides a data sharing method, electronic equipment, a storage medium and a program product. The method comprises the following steps: receiving a data sharing request; wherein the data sharing request is an initial data sharing request which is sent by the block chain and passes permission verification of the smart contract deployed on the block chain; the initial data sharing request is an initial data sharing request sent to the block chain by the data visitor terminal; wherein the data access request comprises an index of to-be-shared data; and according to the index of the to-be-shared data included in the data sharing request, obtaining and sending the to-be-shared data after the temporary encryption processing to the cloud, so that the data visitor terminal obtains the to-be-shared data after the temporary encryption processing from the cloud, and obtains the to-be-shared data according to the to-be-shared data after the temporary encryption processing. The method is used for achieving the effect of improving the security of data sharing.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data sharing method, electronic device, storage medium and program product. Background Art

[0002] Cross-data center data sharing involves the financial data security of banks and the privacy protection of users. Therefore, cross-data center data security sharing has become an urgent problem to be solved.

[0003] Traditional data sharing solutions are based on existing access control models, such as role-based access control model, attribute-based access control model and capability-based access control model.

[0004] However, the existing methods are prone to single point failures, thus affecting the security of data sharing. Summary of the invention

[0005] The embodiments of the present application provide a data sharing method, an electronic device, a storage medium, and a program product to achieve the effect of improving the security of data sharing.

[0006] In a first aspect, an embodiment of the present application provides a data sharing method, which is applied to a data owner terminal, and the method includes:

[0007] Receive a data sharing request; wherein the data sharing request is an initial data sharing request sent by the blockchain after being verified by the authority of the smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by the data accessor terminal to the blockchain; wherein the data access request includes an index of the data to be shared;

[0008] According to the index of the data to be shared included in the data sharing request, the data to be shared that has been temporarily encrypted is obtained and sent to the cloud, so that the data accessor terminal obtains the data to be shared that has been temporarily encrypted from the cloud, and obtains the data to be shared based on the data to be shared that has been temporarily encrypted.

[0009] In one possible implementation, the smart contract deployed in the blockchain includes: an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal and is used to perform access permission verification processing on the initial data sharing request sent by the data accessor terminal; the access control contract includes at least one access control sub-contract; wherein the access control sub-contract corresponds to a data owner terminal and a data accessor terminal; the access control sub-contract includes at least one access control method; wherein the access control method corresponds to a shared data shared by the data owner terminal.

[0010] In a possible implementation, the smart contract deployed in the blockchain also includes: a request judgment contract and a monitoring contract; wherein the request judgment contract is a smart contract deployed by the data owner terminal, which is used to confirm the penalty time indicated by the access control contract according to the processing result of the access control contract; the monitoring contract is a smart contract deployed by the data owner terminal, which manages the access control contract and the request judgment contract; the monitoring contract is used to respond to the initial data sharing request sent by the data accessor terminal, and determine the access control contract and the request judgment contract between the data accessor terminal and the data owner terminal corresponding to the initial data sharing request.

[0011] In a possible implementation, according to the index of the data to be shared included in the data sharing request, obtaining and sending the temporarily encrypted data to be shared to the cloud includes: based on the data center to which the data owner terminal is connected, according to the index of the data to be shared included in the data sharing request, obtaining the encrypted data to be shared from the cloud; based on the data center to which the data owner terminal is connected, decrypting the encrypted data to be shared to obtain the data to be shared; obtaining the owner terminal public key and the visitor terminal public key, and determining a temporary secret key based on the owner terminal public key and the visitor terminal public key; based on the data center to which the data owner terminal is connected, temporarily encrypting the data to be shared according to the temporary secret key, obtaining and sending the temporarily encrypted data to be shared to the cloud.

[0012] In a possible implementation, the method further includes: sending the owner terminal public key to the data accessor terminal, so that the accessor terminal decrypts the temporarily encrypted data to be shared obtained from the cloud based on the data center connected to the data accessor terminal according to the owner terminal public key to obtain the data to be shared.

[0013] In a possible implementation, the method further includes: determining initial data to be shared from local data; wherein the initial data to be shared is data to be shared that is preliminarily determined; encrypting the initial data to be shared based on the data center to which the data owner terminal is connected, obtaining and sending the encrypted initial data to be shared to the cloud; obtaining an index of the encrypted initial data to be shared from the cloud based on the data center to which the data owner terminal is connected; and constructing and deploying a corresponding smart contract in the blockchain based on the index of the encrypted initial data to be shared.

[0014] In a possible implementation, the method further includes: receiving prompt information of the bad data sharing request sent by the blockchain; wherein the prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request, and penalty time information of the visitor terminal corresponding to the bad data sharing request.

[0015] In a second aspect, an embodiment of the present application provides a data sharing device, including:

[0016] A receiving module, configured to receive a data sharing request; wherein the data sharing request is an initial data sharing request sent by the blockchain after being verified by the authority of the smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by the data accessor terminal to the blockchain; wherein the data access request includes an index of the data to be shared;

[0017] The sharing module is used to obtain and send the temporarily encrypted data to be shared to the cloud according to the index of the data to be shared included in the data sharing request, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud and obtains the data to be shared based on the temporarily encrypted data to be shared.

[0018] In one possible implementation, the smart contract deployed in the blockchain includes: an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal and is used to perform access permission verification processing on the initial data sharing request sent by the data accessor terminal; the access control contract includes at least one access control sub-contract; wherein the access control sub-contract corresponds to a data owner terminal and a data accessor terminal; the access control sub-contract includes at least one access control method; wherein the access control method corresponds to a shared data shared by the data owner terminal.

[0019] In a possible implementation, the smart contract deployed in the blockchain also includes: a request judgment contract and a monitoring contract; wherein the request judgment contract is a smart contract deployed by the data owner terminal, which is used to confirm the penalty time indicated by the access control contract according to the processing result of the access control contract; the monitoring contract is a smart contract deployed by the data owner terminal, which manages the access control contract and the request judgment contract; the monitoring contract is used to respond to the initial data sharing request sent by the data accessor terminal, and determine the access control contract and the request judgment contract between the data accessor terminal and the data owner terminal corresponding to the initial data sharing request.

[0020] In a possible implementation, the sharing module is specifically used to obtain the encrypted data to be shared from the cloud based on the data center to which the data owner terminal is connected and according to the index of the data to be shared included in the data sharing request; decrypt the encrypted data to be shared based on the data center to which the data owner terminal is connected to obtain the data to be shared; obtain the owner terminal public key and the visitor terminal public key, and determine a temporary secret key based on the owner terminal public key and the visitor terminal public key; temporarily encrypt the data to be shared based on the temporary secret key based on the data center to which the data owner terminal is connected, and obtain and send the temporarily encrypted data to be shared to the cloud.

[0021] In a possible implementation, the sharing module is further specifically used to send the owner terminal public key to the data accessor terminal, so that the accessor terminal decrypts the temporarily encrypted data to be shared obtained from the cloud based on the data center connected to the data accessor terminal according to the owner terminal public key to obtain the data to be shared.

[0022] In a possible implementation, the sharing module is further specifically used to determine initial data to be shared from local data; wherein the initial data to be shared is data to be shared that is preliminarily determined; based on the data center to which the data owner terminal is connected, the initial data to be shared is encrypted, and the encrypted initial data to be shared is obtained and sent to the cloud; based on the data center to which the data owner terminal is connected, an index of the encrypted initial data to be shared is obtained from the cloud; and according to the index of the encrypted initial data to be shared, a corresponding smart contract is constructed and deployed in the blockchain.

[0023] In a possible implementation, the sharing module is further specifically used to receive prompt information of the bad data sharing request sent by the blockchain; wherein the prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request, and penalty time information of the visitor terminal corresponding to the bad data sharing request.

[0024] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0025] The memory stores computer-executable instructions;

[0026] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0027] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0028] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0029] The data sharing method, electronic device, storage medium and program product provided in the embodiments of the present application receive a data sharing request, obtain and send the temporarily encrypted data to be shared to the cloud according to the index of the data to be shared included in the data sharing request, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud, and obtains the data to be shared according to the temporarily encrypted data to be shared, wherein the data sharing request is an initial data sharing request sent by the blockchain after the authority verification of the smart contract deployed thereon, thereby improving the tamper-proof, transparency and automatic execution of the authority verification process, and further improving the security of data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0031] Figure 1 Schematic diagram of the data sharing scenario provided for this application;

[0032] Figure 2 Schematic diagram of the data sharing method provided for this application Figure 1 ;

[0033] Figure 3 Schematic diagram of the data sharing method provided for this application Figure 2 ;

[0034] Figure 4 An interactive schematic diagram of the data sharing method provided for this application;

[0035] Figure 5 A schematic diagram of the structure of the data sharing device provided by this application;

[0036] Figure 6 A schematic diagram of the structure of the electronic device provided in this application.

[0037] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0038] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0039] Figure 1 The following is a schematic diagram of the data sharing scenario provided for this application, such as Figure 1 As shown, the specific application scenarios of this application include: data owner terminal 101, data access terminal 102, blockchain 103, cloud 104, and data center 105. Among them, this application does not limit the number of data owner terminals 101, data access terminals 102, blockchain 103, cloud 104, and data center 105 included in the data sharing scenario. Figure 1 This is an example of a data sharing scenario involving a data owner terminal 101 , a data accessor terminal 102 , a blockchain 103 , a cloud 104 , and two data centers 105 .

[0040] Specifically, in Figure 1 In the data sharing scenario shown, the blockchain 103 is connected to the data owner terminal 101 and the data accessor terminal 102 , one of the two data centers 105 is connected to the data owner terminal 101 and the cloud 104 , and the other of the two data centers 105 is connected to the data accessor terminal 102 and the cloud 104 .

[0041] The data owner terminal 101 is used to implement the data sharing method described below. The data center 105 connected to the data owner terminal 101 is used to store and transmit the data uploaded by the data owner terminal 101. The cloud 104 is used to store the encrypted initial shared data and the temporarily encrypted data to be shared. The data visitor terminal 102 is used to send the initial data sharing request and obtain the data to be shared. The data center 105 connected to the data owner terminal 101 is used to obtain and send the data to be shared to the data visitor terminal 102.

[0042] In combination with the above scenarios, it can be seen that in the prior art, data sharing solutions are based on existing access control models, such as: role-based access control model, attribute-based access control model and capability-based access control model.

[0043] However, the existing methods are prone to single point failures, thus affecting the security of data sharing.

[0044] The data sharing method provided by the present application receives a data sharing request, obtains and sends the temporarily encrypted data to be shared to the cloud according to the index of the data to be shared included in the data sharing request, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud, and obtains the data to be shared according to the temporarily encrypted data to be shared, wherein the data sharing request is an initial data sharing request sent by the blockchain after the authority verification of the smart contract deployed thereon, thereby improving the tamper-proof, transparency and automatic execution of the authority verification process, and further improving the security of data sharing.

[0045] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0046] Figure 2 Schematic diagram of the data sharing method provided for this application Figure 1 The execution subject is the data owner's terminal or server. Generally speaking, it can be implemented through software, hardware, or a combination of software and hardware. Figure 2 As shown, the method includes:

[0047] Step S201: Receive a data sharing request.

[0048] Specifically, a data sharing request sent by a blockchain can be received. For a description of the blockchain, please refer to Figure 1 The description in the scene diagram shown will not be repeated here.

[0049] The data sharing request is the initial data sharing request sent by the blockchain after the permission verification of the smart contract deployed thereon; the initial data sharing request is the initial data sharing request sent by the data accessor terminal to the blockchain; for the description of the data accessor terminal, please refer to Figure 1The description in the scenario diagram shown is not repeated here. Among them, the smart contract deployed on the blockchain is used to perform permission verification processing on the initial data sharing request sent by the data accessor terminal. Specifically, after the permission verification processing, if it is determined that the data accessor terminal that sends the initial data sharing request has the permission to access the corresponding data to be shared, it is determined that the initial data sharing request has passed the permission verification of the smart contract deployed on the blockchain, otherwise, it is determined that the initial data sharing request has not passed the permission verification of the smart contract deployed on the blockchain.

[0050] The data access request includes an index of the data to be shared; the index of the data to be shared indicates a storage address of the data to be shared. The present application does not limit the storage address of the data to be shared, and optionally, it can be a storage address of the data to be shared in the cloud.

[0051] Step S202: According to the index of the data to be shared included in the data sharing request, the temporarily encrypted data to be shared is obtained and sent to the cloud, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud, and obtains the data to be shared according to the temporarily encrypted data to be shared.

[0052] Specifically, according to the index of the data to be shared included in the data sharing request obtained in step S201, the temporarily encrypted data to be shared can be obtained and sent to the cloud, so that the data access terminal obtains the temporarily encrypted data to be shared from the cloud, and obtains the data to be shared based on the temporarily encrypted data to be shared. Figure 1 As described in the scenario diagram shown, the data to be shared that has been temporarily encrypted can be obtained according to the index of the data to be shared included in the data sharing request, and sent to the cloud through the data center connected thereto.

[0053] Among them, the present application does not limit the process of obtaining and sending the temporarily encrypted data to be shared to the cloud. Optionally, if the storage address of the data to be shared is the storage address of the data to be shared in the cloud, the process of obtaining and sending the temporarily encrypted data to be shared to the cloud includes: obtaining the encrypted data to be shared from the cloud according to the index of the data to be shared included in the data sharing request; decrypting the encrypted data to be shared to obtain the data to be shared; obtaining the owner terminal public key and the visitor terminal public key, and determining the temporary secret key according to the owner terminal public key and the visitor terminal public key; temporarily encrypting the data to be shared according to the temporary secret key, and obtaining and sending the temporarily encrypted data to be shared to the cloud.

[0054] Among them, based on Figure 1As described in the scenario diagram shown, according to the index of the data to be shared included in the data sharing request, the data to be shared that has been temporarily encrypted is obtained and sent to the cloud, so that the data accessor terminal can obtain the data to be shared that has been temporarily encrypted and uploaded by the data owner terminal through the data center connected to it from the cloud through the data center connected to it, and obtain the data to be shared based on the data to be shared that has been temporarily encrypted and processed.

[0055] The data sharing method provided in the embodiment of the present application receives a data sharing request, obtains and sends the temporarily encrypted data to be shared to the cloud according to the index of the data to be shared included in the data sharing request, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud, and obtains the data to be shared according to the temporarily encrypted data to be shared, wherein the data sharing request is an initial data sharing request sent by the blockchain after the authority verification of the smart contract deployed thereon, thereby improving the tamper-proof, transparency and automatic execution of the authority verification process, and further improving the security of data sharing.

[0056] In a possible embodiment, the smart contract deployed in the blockchain includes: an access control contract. The access control contract is a smart contract deployed by the data owner terminal and used to verify access rights for the initial data sharing request sent by the data accessor terminal.

[0057] The access control contract includes at least one access control sub-contract, wherein the access control sub-contract corresponds to a data owner terminal and a data accessor terminal.

[0058] The access control subcontract includes at least one access control method, wherein the access control method corresponds to a shared data shared by the data owner terminal.

[0059] Each access control subcontract maintains an access control table. Each data in each access control table corresponds to an access control method. For example, Table 1 is an example of an access control table provided in this application.

[0060] Table 1

[0061]

[0062] Among them, the attribute information of each parameter in Table 1 is as follows: DATA represents the index of the data to be shared, Data1 represents the index of the data 1 to be shared, and Data2 represents the index of the data 2 to be shared; action represents the access behavior of the visitor to the shared data, for example, read represents the reading behavior, and write represents the writing behavior; available represents the result of the availability detection of the sharing relationship, for example, true represents that the result of the sharing relationship availability detection is available; static Permission represents the predefined static access permission of the access behavior, for example, allow represents allowing access, and deny represents denying access; RT represents the time of the last access to the shared data.

[0063] The access control contract also provides at least one method (Application Programming Interface, or API) to manage policies and implement access control contracts. The API is a set of predefined functions or methods that are designed to provide applications and developers with access to a set of routines without accessing the source code or understanding the details of the internal working mechanism. The main purpose of the API is to simplify the interaction between different software systems and improve development efficiency and system maintainability.

[0064] Among them, this application does not limit the API provided in the access control contract. Optionally, the API provided in the access control contract includes but is not limited to: shutting down an access control method shutdownACC(), adding a new access control method policyAdd(), updating an access control method policyUpdate(), deleting an access control method policyDelete(), implementing static and dynamic verification and returning access results accessControl(), accepting the address of the request judgment contract and setting the instance of the request judgment contract setJC(), at least one of the following methods.

[0065] Specifically, when the blockchain receives a method closing instruction sent by the data owner terminal, the access control method is closed by shutting down a certain access control method shutdownACC() included in the access control contract; when the blockchain receives a method adding instruction sent by the data owner terminal, the access control method is added by adding a new access control method policyAdd() included in the access control contract; when the blockchain receives a method updating instruction sent by the data owner terminal, the access control method is updated by updating a certain access control method policyUpdate() included in the access control contract; when the blockchain receives a method deleting instruction sent by the data owner terminal, the access control method is deleted by deleting a certain access control method policyDelete() included in the access control contract.

[0066] Specifically, after the blockchain receives the data sharing request sent by the data accessor terminal, it determines whether it is a bad data sharing request by implementing static and dynamic verification and returning the access result accessControl() included in the access control contract, and accepting the address of the request judgment contract and setting the instance of the request judgment contract setJC(). If it is determined to be a bad data sharing request, it obtains and sends penalty information to the data owner terminal and / or the data accessor terminal. If it is determined that the data sharing request sent by the data accessor fails to pass the predefined static verification and / or the predefined dynamic verification, the data sharing request is determined to be a bad data sharing request.

[0067] Among them, the predefined static verification includes but is not limited to: determining whether the verification of the predefined static access right static Permission of the access behavior indicates that access is allowed, etc. Among them, the predefined dynamic verification includes but is not limited to: the number of accesses AN within a preset time period is greater than the preset access number threshold threshold, and the time interval between two consecutive accesses is less than the preset time threshold minInterval. Optionally, if the predefined dynamic verification is as described above, the preset access number threshold field threshold, the preset time threshold minInterval, the preset access number threshold field threshold, and the number of accesses within the preset time period field AN can be added to the access control table shown in Table 1 to determine whether the above dynamic verification is passed.

[0068] Among them, the access control contract deployed in the blockchain can verify the data sharing request sent by the visitor terminal, which improves the tamper-proof, transparency and automatic execution of access control, and further improves the security of data sharing. Among them, the access smart contract is edited by the data owner terminal, which improves the autonomy of the data owner and further improves the flexibility of data sharing.

[0069] In a possible embodiment, the smart contract deployed in the blockchain also includes: requesting judgment of the contract and monitoring the contract.

[0070] Among them, the request judgment contract is a smart contract deployed by the data owner terminal, which is used to confirm the penalty time indicated by the access control contract based on the processing result of the access control contract.

[0071] Among them, the penalty time refers to the time period during which the request judgment contract prevents the data access terminal from accessing the shared data based on the bad access record of the data access terminal when the access control contract finds that the data access terminal sends a bad data sharing request. The verification type of the bad sharing request when calling the request judgment contract is different, that is, when the verification type for determining that the data sharing request is a bad data sharing request is different, the corresponding penalty time is also different. For example: if the data sharing request is determined to be a bad data sharing request because the data sharing request fails the static verification described above, the corresponding penalty time can be determined to be the first penalty time, for example, 1 hour; if the data sharing request is determined to be a bad data sharing request because the data sharing request fails the dynamic verification described above, the corresponding penalty time can be determined to be the second penalty time, for example, 2 hours.

[0072] Among them, based on the above description of the request judgment contract and penalty time, each blockchain maintains a bad access record table. For example, Table 2 is an example of a bad access record table provided by this application.

[0073] Table 2

[0074]

[0075] Among them, the attribute information of each parameter in Table 2 is as follows: DataRequest represents the data accessor terminal that has a bad request, for example, Data Center B (DataCenterB); Data represents the shared data accessed by the bad request, for example, DataA; time represents the time when the bad request occurs; penalty represents the penalty time of the data accessor terminal of this bad request; blocktime represents the last time of the blockade, that is, the time point when the penalty time ends.

[0076] Among them, the request judgment contract also provides at least one interface (Application Binary Interface, referred to as ABI) for the access control contract described above to perform access control processing, wherein the ABI contains the programming conventions that the application must comply with when running under this system. The ABI always contains a series of system calls and methods of using these system calls, as well as provisions on memory addresses that the program can use and the use of machine registers. Among them, this application does not limit the ABI provided in the request judgment contract. Optionally, the ABI provided in the request judgment contract includes but is not limited to: misbehaviorJudge, which means to punish the visitor based on the visitor's bad access record and return the result to ACC; getlatestMisbehavior, which means to obtain the visitor's latest bad access, and getLastesBlocktime means to obtain the visitor's blocking time.

[0077] Among them, through the request judgment contract deployed in the blockchain, the data owner terminal can flexibly set the penalty time corresponding to the bad data sharing request, thereby improving the flexibility of data sharing.

[0078] The monitoring contract is a smart contract deployed by the data owner terminal to manage the access control contract and the request judgment contract. The monitoring contract is used to respond to the initial data sharing request sent by the data accessor terminal and determine the access control contract and request judgment contract between the data accessor terminal and the data owner terminal corresponding to the initial data sharing request.

[0079] Among them, each blockchain maintains a smart contract registry. For example, Table 3 is an example of a smart contract registry provided by this application.

[0080] Table 3

[0081]

[0082] Among them, the attribute information of each parameter in Table 2 is as follows: DATAvistor represents the address of the data accessor terminal of the shared data; scName represents the contract name of the registered smart contract, for example, access control contract 1 (ACC1), access control contract 2 (ACC2), request judgment contract JC; scAddress represents the contract address of the smart contract; Msg represents the relevant instructions during the use of the smart contract; ABI represents the intermediate result generated during the deployment of the smart contract, in which, in the blockchain, only by knowing the ABI and the smart contract address can the smart contract be called; available indicates that this attribute is used to determine whether there is an access control contract in the data owner terminal and the data accessor terminal.

[0083] Among them, the monitoring contract also provides at least one interface (Application Binary Interface, referred to as ABI) to improve the management of access control contracts and request judgment contracts. Among them, this application does not limit the ABI provided in the monitoring contract. Optionally, the ABI provided in the monitoring contract includes but is not limited to: methodRegister means receiving relevant registration information, especially the contract address and ABI, and adding the information to the registration table; methodUpdate means receiving the registration information that needs to be modified, especially the contract address and ABI, and updating the registration table; methodDelete means receiving the method serial number and deleting this method; isAvaliable means receiving the visitor address and returning whether there is an access relationship with the visitor; getContract means receiving the method serial number and returning the contract address and ABI of the relevant contract.

[0084] Among them, through the monitoring contract deployed in the blockchain, the data owner terminal can manage the smart contract deployed in the blockchain, thereby improving the flexibility of data sharing.

[0085] Figure 3 Schematic diagram of the data sharing method provided for this application Figure 2 ,like Figure 3 As shown, in this embodiment Figure 2 Based on the embodiment, a process of obtaining and sending temporarily encrypted data to be shared to the cloud according to the index of the data to be shared included in the data sharing request is described in detail. The method includes:

[0086] Step S301: Based on the data center to which the data owner terminal is connected, the encrypted data to be shared is obtained from the cloud according to the index of the data to be shared included in the data sharing request.

[0087] Specifically, based on the data center to which the data owner terminal is connected, the encrypted data to be shared can be obtained from the cloud according to the index of the data to be shared included in the data sharing request. The encrypted data to be shared is the data to be shared pre-stored in the cloud by the data owner terminal. When each data to be shared is stored in the cloud, it corresponds to a fixed index for indicating the storage location of the data to be shared. The data to be shared pre-stored in the cloud is the data encrypted according to the preset encryption policy.

[0088] Among them, the present application does not limit the process of obtaining the encrypted data to be shared from the cloud based on the index of the data to be shared included in the data sharing request for the data center connected to the data owner terminal. Optionally, the index of the data to be shared included in the data sharing request can be sent to the data center connected to the data owner terminal, so that the data center connected to the data owner terminal can obtain the corresponding encrypted data to be shared from the cloud based on the index of the data to be shared included in the data sharing request.

[0089] Among them, this application does not limit the process of storing the data to be shared in the cloud. Any process of storing the data to be shared in the cloud can be used as the process of storing the data to be shared in the cloud provided by this application. Optionally, the initial data to be shared can be determined from the local data first. Among them, the initial data to be shared is the data to be shared that is preliminarily determined. Then, based on the data center to which the data owner's terminal is connected, the initial data to be shared is encrypted, and the encrypted initial data to be shared is obtained and sent to the cloud.

[0090] The local data refers to data stored in the data owner's terminal and / or data generated by the data owner's terminal. The initial data to be shared refers to data to be shared that is preliminarily determined from the local data described above.

[0091] Among them, the present application does not limit the process of encrypting the initial data to be shared based on the data center connected to the data owner terminal, obtaining and sending the encrypted initial data to be shared to the cloud. Optionally, the initial data to be shared can be sent to the data center connected to the data owner terminal, so that the data center connected to the data owner terminal encrypts the received initial data to be shared, and sends the encrypted initial data to be shared to the cloud.

[0092] Among them, the present application does not limit the process of encrypting the received initial data to be shared by the data center connected to the data owner terminal. Optionally, the initial public key and initial private key of the data owner terminal can be obtained based on the elliptic curve encryption algorithm, and then the received initial data to be shared can be encrypted according to the initial public key of the data owner terminal.

[0093] Optionally, after the initial data to be shared is encrypted in the data center connected to the data owner's terminal and the encrypted initial data to be shared is obtained and sent to the cloud, the index of the encrypted initial data to be shared can be obtained from the cloud based on the data center connected to the data owner's terminal. According to the index of the encrypted initial data to be shared, the corresponding smart contract is constructed and deployed in the blockchain.

[0094] Specifically, the present application does not limit the process of obtaining the index of the encrypted initial data to be shared from the cloud based on the data center to which the data owner terminal is connected. Optionally, the index of the encrypted initial data to be shared can be obtained from the data center to which the data owner terminal is connected, wherein the index of the encrypted initial data to be shared in the data center to which the data owner terminal is connected is the index determined by the cloud when storing the encrypted initial data to be shared and sent to the data center to which the data owner terminal is connected.

[0095] Among them, after obtaining the index of the encrypted initial data to be shared from the cloud, the data center based on the data owner's terminal connection can build and deploy the corresponding smart contract in the blockchain according to the index of the encrypted initial data to be shared. Among them, the description of the smart contract built and deployed in the blockchain can refer to the description in the embodiment shown above, which will not be repeated here.

[0096] Step S302: Based on the data center to which the data owner's terminal is connected, the encrypted data to be shared is decrypted to obtain the data to be shared.

[0097] Specifically, in the data center connected to the data owner terminal, according to the index of the data to be shared included in the data sharing request, after obtaining the encrypted data to be shared from the cloud, the encrypted data to be shared can be decrypted based on the data center connected to the data owner terminal to obtain the data to be shared. Among them, the present application does not limit the process of decrypting the encrypted data to be shared based on the data center connected to the data owner terminal to obtain the data to be shared. Optionally, the encrypted data to be shared can be decrypted based on the data center connected to the data owner terminal according to a preset decryption strategy to obtain the data to be shared. Among them, the preset decryption strategy corresponds to the preset encryption strategy described in step S301.

[0098] Optionally, if the process of obtaining the encrypted data to be shared from the cloud based on the index of the data to be shared included in the data sharing request based on the data center to which the data owner terminal is connected is as described in step S301, and the process of encrypting the received initial data to be shared by the data center to which the data owner terminal is connected is as described above, then the process of decrypting the encrypted data to be shared based on the data center to which the data owner terminal is connected to obtain the data to be shared can be: based on the data center to which the data owner terminal is connected, the encrypted data to be shared is decrypted based on the initial private key of the data owner terminal to obtain the data to be shared.

[0099] Step S303: Obtain the owner terminal public key and the visitor terminal public key, and determine the temporary secret key according to the owner terminal public key and the visitor terminal public key.

[0100] Specifically, the owner terminal public key and the visitor terminal public key may be obtained, and the temporary secret key may be determined according to the owner terminal public key and the visitor terminal public key.

[0101] Among them, this application is to obtain the owner's terminal public key EP a The process is not limited, and optionally, the owner terminal public key can be obtained based on the elliptic curve encryption algorithm. b The process is not limited, and optionally, a visitor terminal public key sent by a data visitor terminal and obtained based on an elliptic curve encryption algorithm can be received.

[0102] Specifically, after obtaining the owner terminal public key and the visitor terminal public key, the temporary secret key EK can be determined according to the owner terminal public key and the visitor terminal public key, wherein the temporary secret key EK=EPa *EP b = EP b *EP a .

[0103] Step S304: Based on the data center to which the terminal of the data owner is connected, temporarily encrypt the data to be shared according to the temporary key, obtain the temporarily encrypted data to be shared and send it to the cloud.

[0104] Specifically, based on the data center to which the data owner's terminal is connected, the data to be shared obtained in step S302 may be temporarily encrypted according to the temporary key determined in step S303, and the temporarily encrypted data to be shared may be obtained and sent to the cloud.

[0105] Among them, the present application does not limit the process of temporarily encrypting the shared data based on the temporary key based on the data center connected to the data owner terminal, obtaining and sending the temporarily encrypted data to be shared to the cloud. Optionally, the temporary key determined in step S303 can be sent to the data center connected to the data owner terminal, so that the data center connected to the data owner terminal temporarily encrypts the shared data based on the temporary key, obtains and sends the temporarily encrypted data to be shared to the cloud.

[0106] The embodiment of the present application provides a process for obtaining and sending temporarily encrypted data to be shared according to an index of the data to be shared included in a data sharing request, wherein the encrypted data to be shared is obtained from the cloud according to the index of the data to be shared included in the data sharing request based on a data center connected to a data owner terminal, the encrypted data to be shared is decrypted based on the data center connected to the data owner terminal to obtain the data to be shared, the owner terminal public key and the visitor terminal public key are obtained, and a temporary secret key is determined based on the owner terminal public key and the visitor terminal public key, and the data to be shared is temporarily encrypted based on the temporary secret key based on the data center connected to the data owner terminal to obtain and send the temporarily encrypted data to be shared to the cloud, wherein the encrypted data to be shared can be accurately obtained through the index of the data to be shared, thereby improving the accuracy of data sharing, wherein, after the encrypted data to be shared is decrypted, the shared data is temporarily encrypted by the owner terminal public key and the visitor terminal public key, thereby improving the security of the data process.

[0107] In a possible embodiment, the data sharing method also includes: sending the owner terminal public key to the data accessor terminal, so that the accessor terminal decrypts the temporarily encrypted data to be shared obtained from the cloud based on the data center connected to the data accessor terminal according to the owner terminal public key to obtain the data to be shared.

[0108] For the description of the public key of the owner terminal, reference may be made to the description in step S303, which will not be repeated here. Optionally, after obtaining the public key of the owner terminal, the obtained public key of the owner terminal may be sent to the data accessor terminal, so that the accessor terminal decrypts the temporarily encrypted data to be shared obtained from the cloud based on the data center connected to the data accessor terminal according to the public key of the owner terminal, and obtains the data to be shared.

[0109] Among them, the present application does not limit the process by which the visitor terminal decrypts the temporarily encrypted data to be shared obtained from the cloud based on the data center to which the data visitor terminal is connected according to the public key of the owner terminal to obtain the data to be shared. Optionally, the visitor public key obtained and sent by the data visitor terminal based on the elliptic curve encryption algorithm can be sent to the data center to which the data visitor terminal is connected, so that the data center to which the data visitor terminal is connected can obtain the temporarily encrypted data to be shared from the cloud, and decrypt the temporarily encrypted data to be shared according to the visitor public key to obtain the data to be shared.

[0110] In a possible embodiment, the data sharing method further includes: receiving prompt information of a bad data sharing request sent by the blockchain. The prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request and penalty time information of the visitor terminal corresponding to the bad data sharing request.

[0111] Among them, the description of the bad data sharing request can refer to the description of the bad data sharing request in the above embodiment, which will not be repeated here.

[0112] Specifically, after the blockchain receives the initial data sharing request sent by the data accessor terminal, if it determines, based on the smart contract deployed thereon, that the initial data sharing request sent by the data accessor terminal is a bad data sharing request, it can generate and send a prompt message of the bad data sharing request to the data owner terminal.

[0113] The visitor terminal information corresponding to the bad data sharing request indicates the data visitor terminal that sent the bad data sharing request. The penalty time information of the visitor terminal corresponding to the bad data sharing request indicates the time for punishing the data visitor terminal that sent the bad data sharing request.

[0114] Optionally, while generating and sending prompt information of bad data sharing requests to the data owner terminal, the blockchain may also send prompt information of the bad data sharing requests to the data accessor terminal that sends the bad data sharing requests. Optionally, the prompt information of the bad data sharing request sent to the data accessor terminal that sends the bad data sharing request also indicates the data owner terminal corresponding to the bad data sharing request.

[0115] Figure 4 An interactive schematic diagram of the data sharing method provided in this application.

[0116] The interactive process of the data sharing method involves a data owner terminal, a data access terminal, a cloud, a blockchain and two data centers. The connection relationship between the devices can be referred to as Figure 1 The connection relationship in the scene diagram shown is not repeated here, wherein data center 1 is a data center connected to the data owner terminal and the cloud, and data center line 2 is a data center connected to the data accessor terminal and the cloud.

[0117] Specifically, the data owner terminal determines and sends the initial shared data to the data center 1; the data center 1 encrypts the initial shared data and sends the encrypted initial shared data to the cloud; the cloud stores the encrypted initial shared data and determines the index of the encrypted initial shared data; the data owner terminal obtains the index of the encrypted initial shared data, and builds and deploys a smart contract to the blockchain based on the index of the encrypted initial shared data; the data accessor terminal sends an initial data sharing request to the blockchain; the blockchain performs authority verification on the initial data sharing request through the smart contract deployed thereon, and if the authority verification passes, sends the data sharing request to the data owner terminal; the data owner terminal obtains the encrypted data to be shared from the cloud based on the index of the data to be shared included in the data sharing request, decrypts the encrypted data to be shared, obtains the data to be shared, temporarily encrypts the data to be shared, obtains and sends the temporarily encrypted data to be shared to the cloud; the data center 2 obtains the temporarily encrypted data to be shared from the cloud; the data accessor terminal obtains the data to be shared from the cloud.

[0118] Figure 5 A schematic diagram of the structure of the data sharing device provided in this application, such as Figure 5 As shown, the data sharing device 50 provided in this embodiment includes:

[0119] The receiving module 501 is used to receive a data sharing request; wherein the data sharing request is an initial data sharing request sent by the blockchain after being verified by the authority of the smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by the data accessor terminal to the blockchain; wherein the data access request includes an index of the data to be shared;

[0120] The sharing module 502 is used to obtain and send the temporarily encrypted data to be shared to the cloud according to the index of the data to be shared included in the data sharing request, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud and obtains the data to be shared based on the temporarily encrypted data to be shared.

[0121] In a possible embodiment, the smart contract deployed in the blockchain includes: an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal and is used to perform access permission verification processing on the initial data sharing request sent by the data accessor terminal; the access control contract includes at least one access control sub-contract; wherein the access control sub-contract corresponds to a data owner terminal and a data accessor terminal; the access control sub-contract includes at least one access control method; wherein the access control method corresponds to a shared data shared by the data owner terminal.

[0122] In a possible embodiment, the smart contract deployed in the blockchain also includes: a request judgment contract and a monitoring contract; wherein the request judgment contract is a smart contract deployed by the data owner terminal, which is used to confirm the penalty time indicated by the access control contract according to the processing result of the access control contract; the monitoring contract is a smart contract deployed by the data owner terminal, which manages the access control contract and the request judgment contract; the monitoring contract is used to respond to the initial data sharing request sent by the data accessor terminal, and determine the access control contract and request judgment contract between the data accessor terminal and the data owner terminal corresponding to the initial data sharing request.

[0123] In a possible embodiment, the sharing module 502 is specifically used to obtain the encrypted data to be shared from the cloud based on the index of the data to be shared included in the data sharing request, based on the data center to which the data owner terminal is connected; decrypt the encrypted data to be shared based on the data center to which the data owner terminal is connected to obtain the data to be shared; obtain the owner terminal public key and the visitor terminal public key, and determine the temporary secret key based on the owner terminal public key and the visitor terminal public key; based on the data center to which the data owner terminal is connected, temporarily encrypt the data to be shared based on the temporary secret key, obtain and send the temporarily encrypted data to be shared to the cloud.

[0124] In a possible embodiment, the sharing module 502 is also specifically used to send the owner terminal public key to the data accessor terminal, so that the accessor terminal can decrypt the temporarily encrypted data to be shared obtained from the cloud based on the data center connected to the data accessor terminal according to the owner terminal public key to obtain the data to be shared.

[0125] In a possible embodiment, the sharing module 502 is also specifically used to determine the initial data to be shared from the local data; wherein the initial data to be shared is the data to be shared that is preliminarily determined; based on the data center to which the data owner terminal is connected, the initial data to be shared is encrypted, and the encrypted initial data to be shared is obtained and sent to the cloud; based on the data center to which the data owner terminal is connected, the index of the encrypted initial data to be shared is obtained from the cloud; according to the index of the encrypted initial data to be shared, a corresponding smart contract is constructed and deployed in the blockchain.

[0126] In a possible embodiment, the sharing module 502 is further specifically used to receive prompt information of the bad data sharing request sent by the blockchain; wherein the prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request, and penalty time information of the visitor terminal corresponding to the bad data sharing request.

[0127] The data sharing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0128] Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the device 60 also includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus 604.

[0129] In a specific implementation process, at least one processor 601 executes the computer execution instructions stored in the memory 602, so that at least one processor 601 executes the above method.

[0130] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0131] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0132] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0133] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0134] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0135] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0136] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0137] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0138] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0141] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0142] Those skilled in the art will appreciate that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0143] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data sharing method, characterized in that: Applied to a data owner terminal, the method includes: Receive a data sharing request; wherein the data sharing request is an initial data sharing request sent by the blockchain after being verified by the authority of the smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by the data accessor terminal to the blockchain; wherein the data access request includes an index of the data to be shared; According to the index of the data to be shared included in the data sharing request, the data to be shared that has been temporarily encrypted is obtained and sent to the cloud, so that the data accessor terminal obtains the data to be shared that has been temporarily encrypted from the cloud, and obtains the data to be shared based on the data to be shared that has been temporarily encrypted.

2. The method according to claim 1, characterized in that The smart contracts deployed in the blockchain include: an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal and used to perform access permission verification processing on the initial data sharing request sent by the data accessor terminal; The access control contract includes at least one access control sub-contract; wherein the access control sub-contract corresponds to a data owner terminal and a data accessor terminal; The access control sub-contract includes at least one access control method; wherein the access control method corresponds to a shared data shared by the data owner terminal.

3. The method according to claim 2, characterized in that The smart contracts deployed in the blockchain also include: requesting judgment contracts and monitoring contracts; The request judgment contract is a smart contract deployed by the data owner terminal and used to confirm the penalty time indicated by the access control contract according to the processing result of the access control contract; The monitoring contract is a smart contract deployed by the data owner terminal to manage the access control contract and the request judgment contract; the monitoring contract is used to respond to the initial data sharing request sent by the data accessor terminal, and determine the access control contract and the request judgment contract between the data accessor terminal and the data owner terminal corresponding to the initial data sharing request.

4. The method according to claim 1, characterized in that: According to the index of the data to be shared included in the data sharing request, obtaining and sending the temporarily encrypted data to be shared to the cloud, including: Based on the data center to which the data owner terminal is connected, and according to the index of the data to be shared included in the data sharing request, obtaining the encrypted data to be shared from the cloud; Based on the data center to which the data owner terminal is connected, decrypting the encrypted data to be shared to obtain the data to be shared; Obtaining the owner terminal public key and the visitor terminal public key, and determining a temporary secret key according to the owner terminal public key and the visitor terminal public key; Based on the data center to which the data owner terminal is connected, the data to be shared is temporarily encrypted according to the temporary key, and the temporarily encrypted data to be shared is obtained and sent to the cloud.

5. The method according to claim 4, characterized in that The method further comprises: The owner terminal public key is sent to the data accessor terminal, so that the accessor terminal decrypts the temporarily encrypted data to be shared obtained from the cloud based on the data center connected to the data accessor terminal according to the owner terminal public key to obtain the data to be shared.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Determining initial data to be shared from local data; wherein the initial data to be shared is data to be shared that is preliminarily determined; Based on the data center to which the data owner terminal is connected, encrypting the initial data to be shared, obtaining and sending the encrypted initial data to be shared to the cloud; Based on the data center to which the data owner terminal is connected, obtaining the index of the encrypted initial data to be shared from the cloud; According to the index of the encrypted initial data to be shared, a corresponding smart contract is constructed and deployed in the blockchain.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Receive prompt information of the bad data sharing request sent by the blockchain; wherein the prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request, and penalty time information of the visitor terminal corresponding to the bad data sharing request.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images