Method, electronic device, storage medium, and program product for data sharing

Abstract

Embodiments of the present application provide a data sharing method, an electronic device, a storage medium and a program product. The method comprises: receiving a data sharing request; wherein the data sharing request is an initial data sharing request sent by a data accessor terminal to a blockchain after permission verification by a smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by the data accessor terminal to the blockchain; wherein the data sharing request comprises an index of to-be-shared data; according to the index of the to-be-shared data included in the data sharing request, the to-be-shared data after temporary encryption processing is obtained and sent to the cloud, so that the data accessor terminal obtains the to-be-shared data after temporary encryption processing from the cloud, and obtains the to-be-shared data according to the to-be-shared data after temporary encryption processing. The method is used to improve the security of data sharing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a data sharing method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] Cross-data-center data sharing involves the security of bank financial data and the protection of user privacy. Therefore, cross-data-center data security sharing has become a problem to be solved.

[0003] Traditional data sharing solutions are based on existing access control models, such as role-based access control models, attribute-based access control models, and capability-based access control models.

[0004] However, the method in the prior art is prone to single point failure, thereby affecting the security of data sharing. SUMMARY

[0005] The embodiments of the present application provide a data sharing method, an electronic device, a storage medium and a program product, to achieve the effect of improving the security of data sharing.

[0006] In a first aspect, the embodiments of the present application provide a data sharing method applied to a data owner terminal, and the method comprises:

[0007] receiving a data sharing request; wherein the data sharing request is an initial data sharing request after permission verification by a smart contract deployed on a blockchain, and the initial data sharing request is an initial data sharing request sent by a data access terminal to the blockchain; wherein the data access request includes an index of shared data;

[0008] According to the index of the shared data included in the data sharing request, the temporarily encrypted shared data is obtained and sent to the cloud, so that the data access terminal obtains the temporarily encrypted shared data from the cloud, and obtains the shared data according to the temporarily encrypted shared data.

[0009] In a possible implementation, the smart contract deployed in the blockchain includes an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal for access permission verification processing of the initial data sharing request sent by the data access terminal; the access control contract includes at least one access control sub-contract; wherein the access control sub-contract corresponds to one data owner terminal and one data access terminal; the access control sub-contract includes at least one access control method; wherein the access control method corresponds to one shared data shared by the data owner terminal.

[0010] In a possible implementation, the smart contract deployed in the blockchain further includes: a request judgment contract, a monitoring contract; the request judgment contract is a smart contract deployed by the data owner terminal, used to confirm the punishment time indicated by the access control contract according to the processing result of the access control contract; the monitoring contract is a smart contract deployed by the data owner terminal, used to manage the access control contract and the request judgment contract; the monitoring contract is used to determine the access control contract and the request judgment contract between the data access terminal and the data owner terminal corresponding to the initial data sharing request sent by the data access terminal.

[0011] In a possible implementation, the method further includes: obtaining and sending the temporarily encrypted shared data to the cloud according to the index of the shared data included in the data sharing request, including: obtaining the encrypted shared data from the cloud according to the index of the shared data included in the data sharing request based on the data center connected by the data owner terminal; decrypting the encrypted shared data based on the data center connected by the data owner terminal to obtain the shared data; obtaining the owner terminal public key and the access terminal public key, and determining a temporary key according to the owner terminal public key and the access terminal public key; and performing temporary encryption processing on the shared data based on the data center connected by the data owner terminal according to the temporary key, to obtain and send the temporarily encrypted shared data to the cloud.

[0012] In a possible implementation, the method further includes: sending the owner terminal public key to the data access terminal, so that the access terminal decrypts the temporarily encrypted shared data obtained from the cloud based on the data center connected by the data access terminal according to the owner terminal public key to obtain the shared data.

[0013] In a possible implementation, the method further includes: determining initial shared data from local data; the initial shared data is the data preliminarily determined to be shared; encrypting the initial shared data based on the data center connected by the data owner terminal to obtain and send the encrypted initial shared data to the cloud; obtaining the index of the encrypted initial shared data from the cloud based on the data center connected by the data owner terminal; and constructing and deploying a corresponding smart contract in the blockchain according to the index of the encrypted initial shared data.

[0014] In a possible implementation, the method further includes: receiving prompt information of the bad data sharing request sent by the blockchain; wherein the prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request, and punishment time information of the visitor terminal corresponding to the bad data sharing request.

[0015] In a second aspect, the embodiments of the present application provide a data sharing device, which includes:

[0016] The receiving module is configured to receive a data sharing request; wherein the data sharing request is an initial data sharing request sent by a blockchain after permission verification by a smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by a data visitor terminal to the blockchain; and the data access request includes an index of shared data.

[0017] The sharing module is configured to obtain and send temporarily encrypted shared data to a cloud according to the index of the shared data included in the data sharing request, so that the data visitor terminal obtains the temporarily encrypted shared data from the cloud and obtains the shared data according to the temporarily encrypted shared data.

[0018] In a possible implementation, the smart contract deployed in the blockchain includes an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal and used for access permission verification processing of the initial data sharing request sent by the data visitor terminal; the access control contract includes at least one access control sub-contract; wherein the access control sub-contract corresponds to one data owner terminal and one data visitor terminal; and the access control sub-contract includes at least one access control method; wherein the access control method corresponds to one shared data shared by the data owner terminal.

[0019] In a possible implementation, the smart contract deployed in the blockchain further includes a request judgment contract and a monitoring contract; wherein the request judgment contract is a smart contract deployed by the data owner terminal and used for confirming a punishment time indicated by the access control contract according to a processing result of the access control contract; the monitoring contract is a smart contract deployed by the data owner terminal and used for managing the access control contract and the request judgment contract; and the monitoring contract is configured to determine the access control contract and the request judgment contract between the data visitor terminal and the data owner terminal corresponding to the initial data sharing request sent by the data visitor terminal.

[0020] In a possible implementation, the sharing module is specifically configured to, based on the data center connected by the data owner terminal, acquire the encrypted to-be-shared data from the cloud according to the index of the to-be-shared data included in the data sharing request; based on the data center connected by the data owner terminal, perform decryption processing on the encrypted to-be-shared data to obtain the to-be-shared data; acquire the owner terminal public key and the visitor terminal public key, and determine a temporary secret key according to the owner terminal public key and the visitor terminal public key; based on the data center connected by the data owner terminal, perform temporary encryption processing on the to-be-shared data according to the temporary secret key, and obtain and send the to-be-shared data after the temporary encryption processing to the cloud.

[0021] In a possible implementation, the sharing module is further specifically configured to send the owner terminal public key to the data visitor terminal, so that the visitor terminal performs decryption processing on the to-be-shared data after the temporary encryption processing, which is acquired from the cloud based on the data center connected by the data visitor terminal, according to the owner terminal public key, to obtain the to-be-shared data.

[0022] In a possible implementation, the sharing module is further specifically configured to determine initial to-be-shared data from local data; the initial to-be-shared data is the to-be-shared data determined initially; based on the data center connected by the data owner terminal, perform encryption processing on the initial to-be-shared data, and obtain and send the initial to-be-shared data after the encryption processing to the cloud; based on the data center connected by the data owner terminal, acquire the index of the initial to-be-shared data after the encryption processing from the cloud; and according to the index of the initial to-be-shared data after the encryption processing, construct and deploy a corresponding smart contract in the blockchain.

[0023] In a possible implementation, the sharing module is further specifically configured to receive prompt information of an improper data sharing request sent by the blockchain; the prompt information of the improper data sharing request includes visitor terminal information corresponding to the improper data sharing request and punishment time information of the visitor terminal corresponding to the improper data sharing request.

[0024] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor;

[0025] The memory stores computer execution instructions;

[0026] The processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementations of the first aspect as described above.

[0027] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing computer execution instructions, the computer execution instructions being executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0028] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, the computer program being executed by a processor to implement the first aspect and / or various possible implementation manners of the first aspect.

[0029] The method, the electronic device, the storage medium and the program product provided by the embodiments of the present application receive a data sharing request, obtain and send the temporarily encrypted shared data to the cloud according to the index of the shared data in the data sharing request, so that the data access terminal obtains the temporarily encrypted shared data from the cloud, and obtains the shared data according to the temporarily encrypted shared data. The data sharing request is the initial data sharing request sent by the block chain after the permission verification of the smart contract deployed thereon, so that the tamper resistance, transparency and automatic execution of the permission verification process are improved, and the security of data sharing is further improved. BRIEF DESCRIPTION OF DRAWINGS

[0030] The accompanying drawings, which are incorporated herein and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the present application.

[0031] Figure 1 A scene diagram of data sharing provided by the present application is provided.

[0032] Figure 2 A flowchart of the data sharing method provided by the present application is provided. Figure 1

[0033] Figure 3 A flowchart of the data sharing method provided by the present application is provided. Figure 2

[0034] Figure 4 An interaction diagram of the data sharing method provided by the present application is provided.

[0035] Figure 5 A structure diagram of the data sharing device provided by the present application is provided.

[0036] Figure 6 A structure diagram of the electronic device provided by the present application is provided.

[0037] ​​The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0038] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0039] Figure 1 The data sharing scenario provided for this application is illustrated in the following diagram: Figure 1 As shown, the specific application scenarios of this application include: data owner terminal 101, data visitor terminal 102, blockchain 103, cloud 104, and data center 105. This application does not limit the number of data owner terminals 101, data visitor terminals 102, blockchain 103, cloud 104, and data center 105 included in the data sharing scenario. Figure 1 An example of a data sharing scenario involving a data owner terminal 101, a data visitor terminal 102, a blockchain 103, a cloud 104, and two data centers 105.

[0040] Specifically, in Figure 1 In the data sharing scenario shown, blockchain 103 is connected to data owner terminal 101 and data visitor terminal 102. One of the two data centers 105 is connected to data owner terminal 101 and cloud 104, and the other data center 105 is connected to data visitor terminal 102 and cloud 104.

[0041] The data owner terminal 101 is used to implement the data sharing method described below. The data center 105, connected to the data owner terminal 101, is used to store and transmit data uploaded by the data owner terminal 101. The cloud 104 is used to store the initially shared data after encryption processing and the data to be shared after temporary encryption processing. The data visitor terminal 102 is used to send an initial data sharing request and obtain the data to be shared. The data center 105, connected to the data owner terminal 101, is used to obtain and send the data to be shared to the data visitor terminal 102.

[0042] In combination with the above scenarios, in the prior art, a data sharing scheme is based on an existing access control model, for example, a role-based access control model, an attribute-based access control model, and a capability-based access control model.

[0043] However, the manner in the prior art is prone to single point failure, thereby affecting the security of data sharing.

[0044] The method for data sharing provided in the present application receives a data sharing request, acquires and sends to the cloud temporarily encrypted processed to-be-shared data according to an index of the to-be-shared data included in the data sharing request, so that a data access terminal acquires the temporarily encrypted processed to-be-shared data from the cloud and acquires the to-be-shared data according to the temporarily encrypted processed to-be-shared data, wherein the data sharing request is an initial data sharing request sent by a blockchain after permission verification by a smart contract deployed thereon, thereby improving the tamper-proofing, transparency, and automatic execution of the permission verification process and further improving the security of data sharing.

[0045] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0046] Figure 2 Flowchart of the method for data sharing provided in the present application Figure 1 The execution subject is a data owner terminal or a server, which can be implemented by software, hardware, or a combination of software and hardware. As shown in Figure 2 The method comprises the following steps.

[0047] Step S201, receiving a data sharing request.

[0048] Specifically, a data sharing request sent by a blockchain can be received. The description of the blockchain can refer to the description in the scenario schematic diagram shown in Figure 1 , which will not be described again here.

[0049] The data sharing request is an initial data sharing request sent by the blockchain after permission verification by a smart contract deployed thereon; the initial data sharing request is an initial data sharing request sent by a data access terminal to the blockchain; the description of the data access terminal can refer to the description in the scenario schematic diagram shown in Figure 1The description in the illustrated scenario is not repeated here. Among them, the smart contract deployed on the blockchain is used to verify the initial data sharing request sent by the data access terminal. Specifically, after the permission verification process, if it is determined that the data access terminal sending the initial data sharing request has the permission to access the corresponding shared data, it is determined that the initial data sharing request has passed the permission verification of the smart contract deployed on the blockchain, otherwise, it is determined that the initial data sharing request has not passed the permission verification of the smart contract deployed on the blockchain.

[0050] Among them, the data access request includes the index of the shared data; wherein the index of the shared data indicates the storage address of the shared data. Wherein the storage address of the shared data is not limited in the present application, which can be the storage address of the shared data in the cloud.

[0051] Step S202, according to the index of the shared data included in the data sharing request, the temporarily encrypted shared data is obtained and sent to the cloud, so that the data access terminal obtains the temporarily encrypted shared data from the cloud, and obtains the shared data according to the temporarily encrypted shared data.

[0052] Specifically, according to the index of the shared data included in the data sharing request obtained in step S201, the temporarily encrypted shared data can be obtained and sent to the cloud, so that the data access terminal obtains the temporarily encrypted shared data from the cloud, and obtains the shared data according to the temporarily encrypted shared data. Wherein, based on Figure 1 According to the description in the illustrated scenario, the temporarily encrypted shared data can be obtained according to the index of the shared data included in the data sharing request, and sent to the cloud through the data center connected thereto.

[0053] Wherein, the process of obtaining and sending the temporarily encrypted shared data to the cloud is not limited in the present application, which can be the storage address of the shared data in the cloud. If the storage address of the shared data is the storage address of the shared data in the cloud, the process of obtaining and sending the temporarily encrypted shared data to the cloud includes: obtaining the encrypted shared data from the cloud according to the index of the shared data included in the data sharing request; decrypting the encrypted shared data to obtain the shared data; obtaining the owner terminal public key and the access terminal public key, and determining the temporary secret key according to the owner terminal public key and the access terminal public key; according to the temporary secret key, the shared data is temporarily encrypted to obtain and send the temporarily encrypted shared data to the cloud.

[0054] Wherein, based on Figure 1According to the index of the to-be-shared data included in the data sharing request, the to-be-shared data after temporary encryption processing is acquired and sent to the cloud, so that the data visitor terminal acquires the to-be-shared data after temporary encryption processing uploaded by the data owner terminal through the data center connected thereto from the cloud, and acquires the to-be-shared data according to the to-be-shared data after temporary encryption processing.

[0055] The method for data sharing provided by the embodiments of the present application acquires and sends the to-be-shared data after temporary encryption processing to the cloud according to the index of the to-be-shared data included in the data sharing request, so that the data visitor terminal acquires the to-be-shared data after temporary encryption processing from the cloud, and acquires the to-be-shared data according to the to-be-shared data after temporary encryption processing, wherein the data sharing request is an initial data sharing request sent by the block chain after permission verification by the smart contract deployed thereon, so that the tamper-proof, transparency and automatic execution of the permission verification processing are improved, and the security of data sharing is further improved.

[0056] In a possible embodiment, the smart contract deployed in the block chain includes an access control contract. The access control contract is a smart contract deployed by the data owner terminal for performing access permission verification processing on the initial data sharing request sent by the data visitor terminal.

[0057] The access control contract includes at least one access control sub-contract. The access control sub-contract corresponds to one data owner terminal and one data visitor terminal.

[0058] The access control sub-contract includes at least one access control method. The access control method corresponds to one shared data shared by the data owner terminal.

[0059] Each access control sub-contract maintains an access control table. Each piece of data in each access control table corresponds to one access control method. For example, Table 1 is an access control example provided by the present application.

[0060] Table 1

[0061]

[0062] Wherein, the attribute information of each parameter in Table 1 is as follows: DATA represents the index of the data to be shared, Data1 represents the index of the data 1 to be shared, and Data2 represents the index of the data 2 to be shared; action represents the access behavior of the visitor to the shared data, for example, read represents the read behavior, and write represents the write behavior; available represents the result of the availability detection of the sharing relationship, for example, true represents that the result of the availability detection of the sharing relationship is available; static Permission represents the predefined static access permission of the access behavior, for example, allow represents the permission to access, and deny represents the denial to access; and RT represents the time of the last access to the shared data.

[0063] Wherein, the access control contract further provides at least one method (Application Programming Interface, API for short) for managing the policy and implementing the access control contract, wherein the API is a set of pre-defined functions or methods, which aims to provide the ability of the application program to access a set of routines without accessing the source code or understanding the details of the internal working mechanism. The main purpose of the API is to simplify the interaction between different software systems, improve the development efficiency and the maintainability of the system.

[0064] Wherein, the API provided in the access control contract is not limited by the present application, and the API provided in the access control contract includes but is not limited to at least one of the following methods: shutting down a certain access control method shutdownACC(), adding a new access control method policyAdd(), updating a certain access control method policyUpdate(), deleting a certain access control method policyDelete(), implementing static and dynamic verification and returning an access result accessControl(), accepting a request to judge the address of the contract and setting the instance of the request judgment contract setJC().

[0065] Specifically, when the block chain receives the method shutdown instruction sent by the data owner terminal, the access control method is closed through the shutdownACC() included in the access control contract; when the block chain receives the method increase instruction sent by the data owner terminal, the access control method is added through the policyAdd() included in the access control contract; when the block chain receives the method update instruction sent by the data owner terminal, the access control method is updated through the policyUpdate() included in the access control contract; and when the block chain receives the method delete instruction sent by the data owner terminal, the access control method is deleted through the policyDelete() included in the access control contract.

[0066] Specifically, after the block chain receives the data sharing request sent by the data access terminal, it is determined whether it is an unqualified data sharing request by accessing the static and dynamic verification and returning the access result accessControl() included in the access control contract, and judging the address of the request judgment contract and setting the instance of the request judgment contract setJC(). If it is determined to be an unqualified data sharing request, the punishment information is obtained and sent to the data owner terminal and / or the data access terminal. Wherein, if the data sharing request sent by the data access terminal does not pass the predefined static verification, and / or the predefined dynamic verification, it is determined that the data sharing request is an unqualified data sharing request.

[0067] Wherein, the predefined static verification includes but is not limited to: determining whether the predefined static access permission static Permission of the access behavior is verified to represent allow access, etc. Wherein, the predefined dynamic verification includes but is not limited to: the access times AN in the preset time period is greater than the preset access times threshold threshold, and the time interval of two consecutive accesses is less than the preset time threshold minInterval. Optionally, if the predefined dynamic verification is as described above, the preset access times threshold field threshold, the preset time threshold minInterva, the preset access times threshold field threshold, and the access times in the preset time period AN can be added to the access control table shown in Table 1 to determine whether to pass the dynamic verification.

[0068] Wherein, by deploying the access control contract in the block chain, the data sharing request sent by the access terminal can be verified, which improves the tamper-proof, transparency and automatic execution of access control, and further improves the security of data sharing. Wherein, the access smart contract is edited by the data owner terminal, which improves the autonomy of the data owner, and further improves the flexibility of data sharing.

[0069] In one possible embodiment, the smart contract deployed in the block chain further includes: a request judgment contract, a monitoring contract.

[0070] Wherein, the request judgment contract is a smart contract deployed by the data owner terminal for confirming the punishment time indicated by the access control contract according to the processing result of the access control contract.

[0071] The penalty time refers to a time period during which the data access terminal cannot access the shared data according to the request judgment contract when the access control contract finds that the data access terminal sends a bad data sharing request. Different verification types of the bad sharing request when the request judgment contract is called correspond to different penalty times. For example, if the data sharing request is determined to be a bad data sharing request because the data sharing request does not pass the static verification described above, the corresponding penalty time can be determined to be a first penalty time, for example, 1 hour. If the data sharing request is determined to be a bad data sharing request because the data sharing request does not pass the dynamic verification described above, the corresponding penalty time can be determined to be a second penalty time, for example, 2 hours.

[0072] Based on the above description of the request judgment contract and the penalty time, each blockchain maintains a bad access record table. For example, Table 2 is an example of a bad access record table provided in the present application.

[0073] Table 2

[0074]

[0075] In Table 2, the attribute information of each parameter is as follows: DataRequest represents a data access terminal that appears a bad request, for example, DataCenterB; Data represents shared data accessed by a bad request, for example, DataA; time represents the time when the bad request appears; penalty represents the penalty time of the data access terminal for this bad request; and blocktime represents the last time of the block, that is, the time point when the penalty time ends.

[0076] The request judgment contract also provides at least one Application Binary Interface (ABI) for the access control contract described above to perform access control processing. The ABI includes programming conventions that must be followed by an application running in this system. The ABI always includes a series of system calls and methods for using these system calls, as well as provisions for memory addresses that can be used by the program and the use of machine registers. The ABI provided in the request judgment contract is not limited in the present application. Optionally, the ABI provided in the request judgment contract includes but is not limited to misbehaviorJudge, which indicates making a penalty according to the bad access record of the access terminal and returning the result to the ACC; getlatestMisbehavior, which indicates obtaining the latest bad access of the access terminal; and getLastesBlocktime, which indicates obtaining the blocking time of the access terminal.

[0077] The data owner terminal can flexibly set the punishment time corresponding to the bad data sharing request through the request judgment contract deployed in the blockchain, thereby improving the flexibility of data sharing.

[0078] The monitoring contract is a smart contract deployed by the data owner terminal for managing the access control contract and the request judgment contract. The monitoring contract is used to determine the access control contract and the request judgment contract between the data visitor terminal and the data owner terminal corresponding to the initial data sharing request in response to the initial data sharing request sent by the data visitor terminal.

[0079] Each blockchain maintains a smart contract registration table. For example, Table 3 is an example of a smart contract registration table provided by the present application.

[0080] Table 3

[0081]

[0082] In Table 2, the attribute information of each parameter is as follows: DATAvistor represents the address of the data visitor terminal sharing data; scName represents the contract name of the registered smart contract, for example, access control contract 1 (ACC1), access control contract 2 (ACC2), and request judgment contract JC; scAddress represents the contract address of the smart contract; Msg represents the relevant instructions in the use process of the smart contract; ABI represents the intermediate result generated in the deployment process of the smart contract, wherein only the ABI and the smart contract address in the blockchain can call the smart contract; available represents the attribute used to determine whether there is an access control contract between the data owner terminal and the data visitor terminal.

[0083] The monitoring contract also provides at least one Application Binary Interface (ABI) to improve the management of the access control contract and the request judgment contract. The ABI provided in the monitoring contract is not limited in the present application, and the ABI provided in the monitoring contract includes but is not limited to: methodRegister represents receiving relevant registration information, especially the contract address and ABI, and adding the information to the registration table; methodUpdate represents receiving registration information that needs to be modified, especially the contract address and ABI, and updating the registration table; methodDelete represents receiving a method number and deleting the method; isAvaliable represents receiving a visitor address and returning whether there is an access relationship with the visitor; getContract represents receiving a method number and returning the contract address and ABI of the relevant contract.

[0084] The data owner terminal can manage the smart contract deployed in the blockchain through the monitoring contract deployed in the blockchain, thereby improving the flexibility of data sharing.

[0085] Figure 3 Flowchart of the data sharing method provided in the present application Figure 2 As shown in Figure 3 the embodiment Figure 2 Based on the embodiment, the process of obtaining and sending the temporarily encrypted shared data to the cloud according to the index of the shared data included in the data sharing request is described in detail. The method comprises the following steps:

[0086] Step S301, based on the data center connected by the data owner terminal, obtaining the encrypted shared data from the cloud according to the index of the shared data included in the data sharing request.

[0087] Specifically, based on the data center connected by the data owner terminal, the encrypted shared data can be obtained from the cloud according to the index of the shared data included in the data sharing request. The encrypted shared data is the shared data pre-stored in the cloud by the data owner terminal. Each shared data corresponds to a fixed index when stored in the cloud, which is used to indicate the storage location of the shared data. The shared data pre-stored in the cloud is data encrypted according to a preset encryption strategy.

[0088] In the present application, the process of obtaining the encrypted shared data from the cloud based on the data center connected by the data owner terminal according to the index of the shared data included in the data sharing request is not limited. Alternatively, the index of the shared data included in the data sharing request can be sent to the data center connected by the data owner terminal, so that the data center connected by the data owner terminal obtains the corresponding encrypted shared data from the cloud according to the index of the shared data included in the data sharing request.

[0089] The process of storing the shared data in the cloud is not limited in the present application, and any process of storing the shared data in the cloud can be used as the process of storing the shared data in the cloud provided in the present application. Alternatively, the initial shared data can be determined from the local data. The initial shared data is the initially determined shared data. Then, the initial shared data is encrypted based on the data center connected by the data owner terminal, and the encrypted initial shared data is obtained and sent to the cloud.

[0090] The local data is data stored in the data owner terminal and / or data generated by the data owner terminal. The initial data to be shared is data to be shared determined initially from the local data.

[0091] The data center connected with the data owner terminal can be used to encrypt the initial data to be shared, and the encrypted initial data to be shared can be sent to the cloud.

[0092] The data center connected with the data owner terminal can be used to encrypt the initial data to be shared, and the encrypted initial data to be shared can be sent to the cloud.

[0093] The data center connected with the data owner terminal can be used to encrypt the initial data to be shared, and the encrypted initial data to be shared can be sent to the cloud.

[0094] The data center connected with the data owner terminal can be used to encrypt the initial data to be shared, and the encrypted initial data to be shared can be sent to the cloud.

[0095] The data center connected with the data owner terminal can be used to encrypt the initial data to be shared, and the encrypted initial data to be shared can be sent to the cloud.

[0096] Step S302, based on the data center connected with the data owner terminal, decrypting the encrypted to-be-shared data to obtain the to-be-shared data.

[0097] Specifically, after obtaining the encrypted to-be-shared data from the cloud based on the index of the to-be-shared data included in the data sharing request, the data center connected with the data owner terminal can decrypt the encrypted to-be-shared data to obtain the to-be-shared data. The process of decrypting the encrypted to-be-shared data based on the data center connected with the data owner terminal to obtain the to-be-shared data is not limited in the present application. Alternatively, the encrypted to-be-shared data can be decrypted based on a preset decryption strategy to obtain the to-be-shared data. The preset decryption strategy corresponds to the preset encryption strategy described in step S301.

[0098] Alternatively, if the process of obtaining the encrypted to-be-shared data from the cloud based on the index of the to-be-shared data included in the data sharing request by the data center connected with the data owner terminal is as described in step S301, and the process of encrypting the received initial to-be-shared data by the data center connected with the data owner terminal is as described above, the process of decrypting the encrypted to-be-shared data based on the data center connected with the data owner terminal to obtain the to-be-shared data can be: decrypting the encrypted to-be-shared data based on the initial private key of the data owner terminal to obtain the to-be-shared data.

[0099] Step S303, obtaining the owner terminal public key and the visitor terminal public key, and determining a temporary secret key based on the owner terminal public key and the visitor terminal public key.

[0100] Specifically, the owner terminal public key and the visitor terminal public key can be obtained, and a temporary secret key can be determined based on the owner terminal public key and the visitor terminal public key.

[0101] The process of obtaining the owner terminal public key EP a is not limited in the present application. Alternatively, the owner terminal public key can be obtained based on an elliptic curve encryption algorithm. The process of obtaining the visitor terminal public key EP b is not limited in the present application. Alternatively, the visitor terminal public key obtained based on an elliptic curve encryption algorithm can be received from the data visitor terminal.

[0102] Specifically, after obtaining the owner terminal public key and the visitor terminal public key, a temporary secret key EK can be determined based on the owner terminal public key and the visitor terminal public key, where the temporary secret key EK = EPa *EP b = EP b * EP a .

[0103] In step S304, the data center connected with the data owner terminal temporarily encrypts the data to be shared according to the temporary key, and sends the temporarily encrypted data to the cloud.

[0104] Specifically, the data center connected with the data owner terminal temporarily encrypts the data to be shared according to the temporary key determined in step S303, and sends the temporarily encrypted data to the cloud.

[0105] In the present application, the process of temporarily encrypting the data to be shared according to the temporary key by the data center connected with the data owner terminal, and sending the temporarily encrypted data to the cloud is not limited, and the temporary key determined in step S303 can be sent to the data center connected with the data owner terminal, so that the data center connected with the data owner terminal temporarily encrypts the data to be shared according to the temporary key, and sends the temporarily encrypted data to the cloud.

[0106] According to the index of the data to be shared included in the data sharing request, the temporarily encrypted data to be shared is obtained and sent to the cloud. According to the index of the data to be shared included in the data sharing request, the encrypted data to be shared is obtained from the cloud by the data center connected with the data owner terminal. The data center connected with the data owner terminal decrypts the encrypted data to be shared, obtains the data to be shared, obtains the public key of the owner terminal and the public key of the visitor terminal, and determines the temporary key according to the public key of the owner terminal and the public key of the visitor terminal. According to the temporary key, the data to be shared is temporarily encrypted by the data center connected with the data owner terminal, and the temporarily encrypted data to be shared is obtained and sent to the cloud. Through the index of the data to be shared, the encrypted data to be shared can be accurately obtained, and the accuracy of data sharing is improved. After the encrypted data to be shared is decrypted, the data to be shared is temporarily encrypted by the public key of the owner terminal and the public key of the visitor terminal, which can improve the security of the data process.

[0107] In a possible implementation, the method for sharing data further includes: sending the owner terminal public key to the data visitor terminal, so that the visitor terminal decrypts the temporarily encrypted to-be-shared data obtained from the cloud based on the data center connected with the data visitor terminal according to the owner terminal public key, to obtain the to-be-shared data.

[0108] The description of the owner terminal public key can refer to the description in step S303, and will not be repeated here. Optionally, after obtaining the owner terminal public key, the obtained owner terminal public key can be sent to the data visitor terminal, so that the visitor terminal decrypts the temporarily encrypted to-be-shared data obtained from the cloud based on the data center connected with the data visitor terminal according to the owner terminal public key, to obtain the to-be-shared data.

[0109] The process of decrypting the temporarily encrypted to-be-shared data obtained from the cloud based on the data center connected with the data visitor terminal according to the owner terminal public key by the visitor terminal is not limited in the application, and the data visitor terminal public key obtained and sent by the data visitor terminal based on the elliptic curve encryption algorithm can be sent to the data center connected with the data visitor terminal, so that the data center connected with the data visitor terminal obtains the temporarily encrypted to-be-shared data from the cloud, and decrypts the temporarily encrypted to-be-shared data according to the data visitor terminal public key to obtain the to-be-shared data.

[0110] In a possible implementation, the method for sharing data further includes: receiving prompt information of an unqualified data sharing request sent by a blockchain. The prompt information of the unqualified data sharing request includes: visitor terminal information corresponding to the unqualified data sharing request, and punishment time information of the visitor terminal corresponding to the unqualified data sharing request.

[0111] The description of the unqualified data sharing request can refer to the description of the unqualified data sharing request in the above embodiments, and will not be repeated here.

[0112] Specifically, after receiving the initial data sharing request sent by the data visitor terminal, if it is determined according to the smart contract deployed thereon that the initial data sharing request sent by the data visitor terminal is an unqualified data sharing request, the blockchain can generate and send prompt information of the unqualified data sharing request to the data owner terminal.

[0113] The visitor terminal information corresponding to the unqualified data sharing request indicates the data visitor terminal that sends the unqualified data sharing request. The punishment time information of the visitor terminal corresponding to the unqualified data sharing request indicates the time for punishing the data visitor terminal that sends the unqualified data sharing request.

[0114] Optionally, the blockchain can also send the prompt information of the bad data sharing request to the data access terminal that sends the bad data sharing request to the data, while generating and sending the prompt information of the bad data sharing request to the data owner terminal. Optionally, the prompt information of the bad data sharing request sent to the data access terminal that sends the bad data sharing request to the data also indicates the data owner terminal corresponding to the bad data sharing request.

[0115] Figure 4 An interaction schematic diagram of the data sharing method provided in the present application.

[0116] The interaction process of the data sharing method involves one data owner terminal, one data access terminal, one cloud, one blockchain and two data centers. The connection relationship between the devices can refer to the connection relationship in the scene schematic diagram shown in Figure 1 The connection relationship in the scene schematic diagram shown in

[0117] Specifically, the data owner terminal determines and sends initial shared data to the data center 1; the data center 1 performs encryption processing on the initial shared data and sends the initial shared data after encryption processing to the cloud; the cloud stores the initial shared data after encryption processing and determines the index of the initial shared data after encryption processing; the data owner terminal acquires the index of the initial shared data after encryption processing and constructs and deploys a smart contract to the blockchain according to the index of the initial shared data after encryption processing; the data access terminal sends an initial data sharing request to the blockchain; the blockchain performs permission verification processing on the initial data sharing request through the smart contract deployed thereon, and if the permission verification processing is passed, sends a data sharing request to the data owner terminal; the data owner terminal acquires encrypted shared data from the cloud according to the index of the shared data included in the data sharing request, performs decryption processing on the encrypted shared data to obtain the shared data, performs temporary encryption processing on the shared data, obtains and sends the shared data after temporary encryption processing to the cloud; the data center 2 acquires the shared data after temporary encryption processing from the cloud; and the data access terminal acquires the shared data from the cloud.

[0118] Figure 5 A structure schematic diagram of the data sharing device provided in the present application, as shown in Figure 5 The data sharing device 50 provided in the present embodiment includes:

[0119] The receiving module 501 is configured to receive a data sharing request; the data sharing request is an initial data sharing request sent by a data visitor terminal to a blockchain after passing permission verification of a smart contract deployed on the blockchain; the initial data sharing request is an initial data sharing request sent by the data visitor terminal to the blockchain; the data access request includes an index of to-be-shared data.

[0120] The sharing module 502 is configured to obtain and send to-be-shared data after temporary encryption processing to the cloud according to the index of the to-be-shared data included in the data sharing request, so that the data visitor terminal obtains the to-be-shared data after temporary encryption processing from the cloud and obtains the to-be-shared data according to the to-be-shared data after temporary encryption processing.

[0121] In a possible embodiment, the smart contract deployed in the blockchain includes an access control contract; the access control contract is a smart contract deployed by a data owner terminal and used for access permission verification processing of an initial data sharing request sent by a data visitor terminal; the access control contract includes at least one access control sub-contract; the access control sub-contract corresponds to one data owner terminal and one data visitor terminal; the access control sub-contract includes at least one access control method; the access control method corresponds to one shared data shared by the data owner terminal.

[0122] In a possible embodiment, the smart contract deployed in the blockchain further includes a request judgment contract and a monitoring contract; the request judgment contract is a smart contract deployed by the data owner terminal and used for confirming a punishment time indicated by the access control contract according to a processing result of the access control contract; the monitoring contract is a smart contract deployed by the data owner terminal and used for managing the access control contract and the request judgment contract; the monitoring contract is configured to determine the access control contract and the request judgment contract between the data visitor terminal and the data owner terminal corresponding to the initial data sharing request sent by the data visitor terminal.

[0123] In a possible embodiment, the sharing module 502 is specifically configured to obtain encrypted to-be-shared data from the cloud based on a data center connected by the data owner terminal according to the index of the to-be-shared data included in the data sharing request; perform decryption processing on the encrypted to-be-shared data based on the data center connected by the data owner terminal to obtain the to-be-shared data; obtain a public key of the owner terminal and a public key of the visitor terminal, and determine a temporary secret key according to the public key of the owner terminal and the public key of the visitor terminal; perform temporary encryption processing on the to-be-shared data based on the data center connected by the data owner terminal according to the temporary secret key, and obtain and send the to-be-shared data after temporary encryption processing to the cloud.

[0124] In a possible implementation, the sharing module 502 is further configured to send the owner terminal public key to the data visitor terminal, so that the visitor terminal decrypts the temporarily encrypted to-be-shared data obtained from the cloud based on the data visitor terminal connection data center according to the owner terminal public key, and obtains the to-be-shared data.

[0125] In a possible implementation, the sharing module 502 is further configured to determine initial to-be-shared data from the local data; wherein the initial to-be-shared data is the to-be-shared data determined initially; encrypt the initial to-be-shared data based on the data owner terminal connection data center, obtain and send the encrypted initial to-be-shared data to the cloud; obtain the index of the encrypted initial to-be-shared data from the cloud based on the data owner terminal connection data center; and construct and deploy the corresponding smart contract in the blockchain according to the index of the encrypted initial to-be-shared data.

[0126] In a possible implementation, the sharing module 502 is further configured to receive prompt information of the bad data sharing request sent by the blockchain; wherein the prompt information of the bad data sharing request includes: visitor terminal information corresponding to the bad data sharing request, and punishment time information of the visitor terminal corresponding to the bad data sharing request.

[0127] The data sharing apparatus provided in this embodiment can execute the method provided in the method embodiment, and has similar implementation principles and technical effects, which will not be described here in detail.

[0128] Figure 6 The structure schematic diagram of the electronic device provided in this application is shown in FIG. 6. Figure 6 As shown in FIG. 6, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the device 60 further includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected through a bus 604.

[0129] In the specific implementation process, the at least one processor 601 executes the computer execution instructions stored in the memory 602, so that the at least one processor 601 executes the method described above.

[0130] The specific implementation process of the processor 601 can refer to the method embodiment described above, and has similar implementation principles and technical effects, which will not be described here in detail.

[0131] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0132] The memory can include a random access memory (RAM), and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0133] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0134] The present application also provides a computer program product, comprising a computer program, which is executed by a processor to implement the above method.

[0135] The present application also provides a computer readable storage medium, which stores computer execution instructions, and when a processor executes the computer execution instructions, the above method is implemented.

[0136] The above readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0137] An example readable storage medium is coupled to the processor such that the processor can read information from the readable storage medium and can write information to the readable storage medium. Of course, the readable storage medium can also be a part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0138] The division of units is only a logical functional division, and in actual implementation, there can be another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0139] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0140] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0141] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0142] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a computer readable storage medium. The program executes the steps of the above-mentioned method embodiments when executed. The foregoing storage medium includes various storage media that can store program codes, such as ROM, RAM, magnetic disk or optical disk.

[0143] Finally, it should be noted that other embodiments of the present application will readily occur to those skilled in the art upon consideration of the specification and practice of the present application disclosed herein. The present application is intended to include all such variations as fall within the general scope of the application, and includes the generic principles disclosed and the best mode known to the inventors to be currently practiced as well as variations thereof, without limiting the present application to any one of the precise arrangements shown and described herein. The scope of the present application is limited only by the claims that follow.

Claims

1. A method of data sharing, characterized by, The method applied to a data owner terminal comprises: receiving a data sharing request; wherein the data sharing request is an initial data sharing request sent by a data accessor terminal to a blockchain after passing the permission verification of a smart contract deployed thereon; wherein the initial data sharing request comprises an index of data to be shared; obtaining and sending temporarily encrypted data to be shared to a cloud according to the index of the data to be shared comprised in the data sharing request, so that the data accessor terminal obtains the temporarily encrypted data to be shared from the cloud and obtains the data to be shared according to the temporarily encrypted data to be shared; obtaining and sending temporarily encrypted data to be shared to a cloud according to the index of the data to be shared comprised in the data sharing request, comprising: obtaining encrypted data to be shared from the cloud according to the index of the data to be shared comprised in the data sharing request based on a data center connected by the data owner terminal; decrypting the encrypted data to be shared based on the data center connected by the data owner terminal to obtain the data to be shared; obtaining an owner terminal public key and an accessor terminal public key, and determining a temporary secret key according to the owner terminal public key and the accessor terminal public key; temporarily encrypting the data to be shared according to the temporary secret key based on the data center connected by the data owner terminal to obtain and send the temporarily encrypted data to be shared to the cloud.

2. The method of claim 1, wherein, The smart contract deployed in the blockchain comprises: an access control contract; wherein the access control contract is a smart contract deployed by the data owner terminal for performing access permission verification processing on the initial data sharing request sent by the data accessor terminal; The access control contract comprises at least one access control sub-contract; wherein the access control sub-contract corresponds to one data owner terminal and one data accessor terminal; The access control sub-contract comprises at least one access control method; wherein the access control method corresponds to one shared data shared by a data owner terminal.

3. The method of claim 2, wherein, The smart contract deployed in the blockchain further comprises: a request judgment contract and a monitoring contract; The request judgment contract is a smart contract deployed by the data owner terminal for confirming the punishment time indicated by the access control contract according to the processing result of the access control contract; The monitoring contract is a smart contract deployed by the data owner terminal for managing the access control contract and the request judgment contract; the monitoring contract is used to determine the access control contract and the request judgment contract between the data accessor terminal and the data owner terminal corresponding to the initial data sharing request sent by the data accessor terminal.

4. The method of claim 1, wherein, The method further comprises: The data owner terminal public key is sent to the data visitor terminal, so that the visitor terminal decrypts the temporary encrypted to-be-shared data obtained from the cloud based on the data owner terminal public key based on a data center connected to the data visitor terminal, to obtain the to-be-shared data.

5. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: determining initial to-be-shared data from local data; wherein the initial to-be-shared data is to-be-shared data determined initially; encrypting the initial to-be-shared data based on a data center connected to the data owner terminal, to obtain and send the encrypted initial to-be-shared data to the cloud; obtaining an index of the encrypted initial to-be-shared data from the cloud based on the data center connected to the data owner terminal; constructing and deploying a corresponding smart contract in the blockchain based on the index of the encrypted initial to-be-shared data.

6. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: receiving prompt information of an improper data sharing request sent by the blockchain; wherein the prompt information of the improper data sharing request comprises visitor terminal information corresponding to the improper data sharing request and punishment time information of the visitor terminal corresponding to the improper data sharing request.

7. An electronic device, comprising: comprise: a memory and a processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the processor executes the method of any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method of any one of claims 1-6.

9. A computer program product, characterised in that, The computer program is executed by the processor to implement the method of any one of claims 1-6.

Images